Execution via WMI CommandLine Event Consumer

[rule]
description = """
Identifies the creation or execution via the Windows Management Instrumentation CommandLine Event Consumer class. The
CommandLineEventConsumer class starts an arbitrary process in the local system when an event is delivered to it.
"""
id = "fd597bc7-8cf6-4dec-8bc0-bda7696bbbdb"
license = "Elastic License v2"
name = "Execution via WMI CommandLine Event Consumer"
os_list = ["windows"]
reference = [
    "https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/",
    "https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer",
]
version = "1.0.10"

query = '''
process where event.action == "start" and
(
 (process.parent.executable : "?:\\Windows\\Sys*\\wbem\\WmiPrvSE.exe" and
  /* wbemcons.dll - WMI Standard Event Consumers */
  process.parent.thread.Ext.call_stack_summary : "*wbemcons.dll*") or

 (process.pe.original_file_name : "wmic.exe" and process.command_line : "*create*" and process.command_line : "*CommandLineEventConsumer*")
) and
 not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
      process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
 not process.executable : "?:\\Windows\\System32\\chkntfs.exe" and
 not process.hash.sha256 : "c4ecbd9e75fbe2d8ab5f4d94d663207d2b73ec924ba9e27b5df9560818ff1105"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.7.0"