Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

title: Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution
id: b4a4a59f-e556-4602-bb5e-49a856c82916
status: test
description: This rule flags process executions where the parent process is EdgeTransport.exe and the spawned activity is consistent with a WMI backdoor using WMI event filters. Such behavior matters because WMI event subscriptions can provide stealthy persistence and code execution tied to system or application events. It relies on Windows process creation telemetry, matching the parent image path and excluding known benign OleConverter/conhost scenarios.
references:
  - https://twitter.com/cglyer/status/1182389676876980224
  - https://twitter.com/cglyer/status/1182391019633029120
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-11
modified: 2023-02-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EdgeTransport.exe
  filter_conhost:
    Image: C:\Windows\System32\conhost.exe
  filter_oleconverter:
    Image|startswith: C:\Program Files\Microsoft\Exchange Server\
    Image|endswith: \Bin\OleConverter.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b
    type: derived