Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

FreeUnreviewedSigmahighv1

suspicious-powershell-wscript-activity-in-wmi-event-consumer-commands-fe21810c

title: Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands
id: 1eae6e9a-c15a-4550-ac01-8239bfdddd9d
status: test
description: This rule flags WMI event consumer command lines that reference scripting and download execution patterns, including PowerShell-style use of New-Object with Net.WebClient and DownloadString/DownloadFile, as well as common IEX/encoding and base64-related constructs. Such activity is relevant because WMI event subscriptions can be abused to run attacker-supplied scripts persistently or at scheduled triggers. It relies on telemetry from Windows WMI event logs that record the consumer Destination command text.
references:
  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
  - https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19
  - https://github.com/RiccardoAncarani/LiquidSnake
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Huntrule Team
date: 2019-04-15
modified: 2023-09-09
tags:
  - attack.execution
  - attack.t1059.005
logsource:
  product: windows
  category: wmi_event
detection:
  selection_destination:
    - Destination|contains|all:
        - new-object
        - net.webclient
        - .downloadstring
    - Destination|contains|all:
        - new-object
        - net.webclient
        - .downloadfile
    - Destination|contains:
        - " iex("
        - " -nop "
        - " -noprofile "
        - " -decode "
        - " -enc "
        - WScript.Shell
        - System.Security.Cryptography.FromBase64Transform
  condition: selection_destination
falsepositives:
  - Legitimate administrative scripts
level: high
license: DRL-1.1
related:
  - id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0
    type: derived

What it detects

This rule flags WMI event consumer command lines that reference scripting and download execution patterns, including PowerShell-style use of New-Object with Net.WebClient and DownloadString/DownloadFile, as well as common IEX/encoding and base64-related constructs. Such activity is relevant because WMI event subscriptions can be abused to run attacker-supplied scripts persistently or at scheduled triggers. It relies on telemetry from Windows WMI event logs that record the consumer Destination command text.

Known false positives

Legitimate administrative scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.