huntrule

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

FreeReviewedSigma · High · v1
Product
windows
Category
wmi_event
Author
Florian Roth (Nextron Systems), Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
Published
2019-04-15
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags WMI event consumer command lines that reference scripting and download execution patterns, including PowerShell-style use of New-Object with Net.WebClient and DownloadString/DownloadFile, as well as common IEX/encoding and base64-related constructs. Such activity is relevant because WMI event subscriptions can be abused to run attacker-supplied scripts persistently or at scheduled triggers. It relies on telemetry from Windows WMI event logs that record the consumer Destination command text.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Malicious mshta Launching WScript VBScript Loader
Suspicious wscript Execution Forcing VBScript Engine in Batch Mode
Suspicious Batch Script Execution Spawned by wscript via VBScript
Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)
Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain
Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host
Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse
Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)
Suspicious System Reconnaissance via Windows Script Host
Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands
Pivot detection · T1059.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.