detection.wiki

Detection rules › Sigma

Potential Remote WMI ActiveScriptEventConsumers Activity

Status
test
Severity
medium
Log source
product windows, service security
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
github.com/SigmaHQ/sigma

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription
Privilege EscalationT1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4624An account was successfully logged on.

Rule body yaml

title: Potential Remote WMI ActiveScriptEventConsumers Activity
id: 9599c180-e3a8-4743-8f92-7fb96d3be648
status: test
description: |
    Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network.
    This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
references:
    - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-09-02
modified: 2024-09-02
tags:
    - attack.lateral-movement
    - attack.privilege-escalation
    - detection.threat-hunting
    - attack.persistence
    - attack.t1546.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        ProcessName|endswith: 'scrcons.exe'
    filter_main_local_system:
        TargetLogonId: '0x3e7' # Local System
    condition: selection and not 1 of filter_main_*
falsepositives:
    - SCCM
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    EventID: 4624
    LogonType: 3
    ProcessName|endswith: 'scrcons.exe'

Stage 2: not filter_main_local_system

filter_main_local_system:
    TargetLogonId: '0x3e7'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
TargetLogonIdeq0x3e7

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
LogonTypeeq
  • 3 corpus 40 (splunk 13, sigma 12, elastic 9, kusto 6)
ProcessNameends_with
  • scrcons.exe