Potential Remote WMI ActiveScriptEventConsumers Activity

Status: test
Severity: medium
Log source: product windows, service security
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.

Known false positives

SCCM

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.003` Event Triggered Execution: Windows Management Instrumentation Event Subscription
Privilege Escalation	`T1546.003` Event Triggered Execution: Windows Management Instrumentation Event Subscription

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Potential Remote WMI ActiveScriptEventConsumers Activity
id: 9599c180-e3a8-4743-8f92-7fb96d3be648
status: test
description: |
    Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network.
    This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
references:
    - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-09-02
modified: 2024-09-02
tags:
    - attack.lateral-movement
    - attack.privilege-escalation
    - detection.threat-hunting
    - attack.persistence
    - attack.t1546.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        ProcessName|endswith: 'scrcons.exe'
    filter_main_local_system:
        TargetLogonId: '0x3e7' # Local System
    condition: selection and not 1 of filter_main_*
falsepositives:
    - SCCM
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    EventID: 4624
    LogonType: 3
    ProcessName|endswith: 'scrcons.exe'

Stage 2: `not filter_main_local_system`

filter_main_local_system:
    TargetLogonId: '0x3e7'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetLogonId`	eq	`0x3e7`	`excludes:TargetLogonId` `field:"TargetLogonId" value:"0x3e7"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`LogonType`	eq	`3` corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)	`field:"LogonType" kind:eq value:"3"`
`ProcessName`	ends_with	`scrcons.exe`	`field:"process_name" kind:ends_with value:"scrcons.exe"`