Windows WMI Persistence via Subscription Namespace ObjectType (Security Event 4662)

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.

FreeUnreviewedSigmamediumv1

windows-wmi-persistence-via-subscription-namespace-objecttype-security-event-466-f033f3f3

title: Windows WMI Persistence via Subscription Namespace ObjectType (Security Event 4662)
id: 5ec73ec3-7e8d-4f4c-8f42-e39543ee7f80
related:
  - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
    type: derived
  - id: f033f3f3-fd24-4995-97d8-a3bb17550a88
    type: derived
status: test
description: This rule flags Security Event ID 4662 where access is made to the WMI Namespace object and the object name contains the term "subscription." Such activity is consistent with setting up or modifying WMI persistence mechanisms, because WMI event subscriptions can be used to trigger attacker-controlled execution. It relies on Windows Security audit telemetry reporting ObjectType as "WMI Namespace" along with matching the "subscription" substring in ObjectName.
references:
  - https://twitter.com/mattifestation/status/899646620148539397
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_wmi_persistence.yml
author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community, Huntrule Team
date: 2017-08-22
modified: 2022-11-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: WMI Namespace
    ObjectName|contains: subscription
  condition: selection
falsepositives:
  - Unknown (data set is too small; further testing needed)
level: medium
license: DRL-1.1

What it detects

This rule flags Security Event ID 4662 where access is made to the WMI Namespace object and the object name contains the term "subscription." Such activity is consistent with setting up or modifying WMI persistence mechanisms, because WMI event subscriptions can be used to trigger attacker-controlled execution. It relies on Windows Security audit telemetry reporting ObjectType as "WMI Namespace" along with matching the "subscription" substring in ObjectName.

Known false positives

Unknown (data set is too small; further testing needed)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.