huntrule

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

FreeReviewedSigma · High · v1
Product
windows
Category
wmi_event
Author
Florian Roth (Nextron Systems), Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
Published
2019-04-15
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags WMI event consumer command lines that reference scripting and download execution patterns, including PowerShell-style use of New-Object with Net.WebClient and DownloadString/DownloadFile, as well as common IEX/encoding and base64-related constructs. Such activity is relevant because WMI event subscriptions can be abused to run attacker-supplied scripts persistently or at scheduled triggers. It relies on telemetry from Windows WMI event logs that record the consumer Destination command text.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Malicious PathWiper Loader Script Execution from Windows Temp via WScript
Suspicious Office Application Spawning Script Or Shell Interpreter
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Suspicious MSHTA VBScript WScript Shell Execution
Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Malicious LitterDrifter VBScript Execution via wscript trash.dll
Suspicious Script Host Spawning PowerShell via BlindEagle Chain
Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands
Pivot detection · T1059.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.