Windows WMI Persistence via Command Line Event Consumers (WmiPrvSE.exe loading wbemcons.dll)

Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.

FreeUnreviewedSigmahighv1

windows-wmi-persistence-via-command-line-event-consumers-wmiprvse-exe-loading-wb-05936ce2

title: Windows WMI Persistence via Command Line Event Consumers (WmiPrvSE.exe loading wbemcons.dll)
id: 0701218b-8d0f-456d-9716-85df918350cd
status: test
description: This rule flags instances where the WMI provider process WmiPrvSE.exe loads the wbemcons.dll module, which is associated with WMI command line event consumer activity. Attackers can use WMI event consumers to maintain persistence and trigger execution through system-managed WMI mechanisms. The detection relies on Windows image load telemetry indicating the exact process image path and the module loaded with a matching ending path segment.
references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml
author: Thomas Patzke, Huntrule Team
date: 2018-03-07
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.t1546.003
  - attack.persistence
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image: C:\Windows\System32\wbem\WmiPrvSE.exe
    ImageLoaded|endswith: \wbemcons.dll
  condition: selection
falsepositives:
  - Unknown (data set is too small; further testing needed)
level: high
license: DRL-1.1
related:
  - id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6
    type: derived

What it detects

This rule flags instances where the WMI provider process WmiPrvSE.exe loads the wbemcons.dll module, which is associated with WMI command line event consumer activity. Attackers can use WMI event consumers to maintain persistence and trigger execution through system-managed WMI mechanisms. The detection relies on Windows image load telemetry indicating the exact process image path and the module loaded with a matching ending path segment.

Known false positives

Unknown (data set is too small; further testing needed)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.