Query: rule covering Detects creation of WMI event subscription persistence method
Matching passage: Sigma rule: Detects creation of WMI event subscription persistence method. Logsource: windows / wmi_event. Rule: title: WMI Event Subscription id: 0f06a3a5-6a09-413f-8743-e6cf35561297 status: test description: Detects creation of WMI event subscription persistence method references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection: EventID: - 19 - 20 - 21 condition: selection falsepositives: - Exclude legitimate (vetted) use of WMI event subscription in your network level: medium
Near-miss passage: Sigma rule: Detects suspicious new RUN key element pointing to an executable in a suspicious folder. Logsource: windows / registry_set. Rule: title: New RUN Key Pointing to Suspicious Folder id: 02ee49e2-e294-4d0f-9278-f5b3212fc588 status: experimental description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2018-08-25 modified: 2025-10-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: Details|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: Details|contains: :\Users\ selection_suspicious_paths_user_2: Details|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos filter_main_windows_update: TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\ Image|startswith: C:\Windows\SoftwareDistribution\Download\ Details|contains|all: - 'rundll32.exe ' - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 Details|contains: - \AppData\Local\Temp\ - C:\Windows\Temp\ filter_optional_spotify: Image|endswith: - C:\Program Files\Spotify\Spotify.exe - C:\Program Files (x86)\Spotify\Spotify.exe - \AppData\Roaming\Spotify\Spotify.exe TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Details|endswith: Spotify.exe --autostart --minimized condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software using weird folders for updates level: high