WMI Event Subscription

Detects creation of WMI event subscription persistence method

Rule Content

- title: WMI Event Subscription
  id: 0f06a3a5-6a09-413f-8743-e6cf35561297
  status: experimental
  description: Detects creation of WMI event subscription persistence method
  references:
  - https://attack.mitre.org/techniques/T1084/
  tags:
  - attack.t1084
  - attack.persistence
  author: Tom Ueltschi (@c_APT_ure)
  date: 2019/01/12
  logsource:
    product: windows
    service: sysmon
    category: null
  detection:
    selector:
      EventID:
      - 19
      - 20
      - 21
    condition: selector
  falsepositives:
  - exclude legitimate (vetted) use of WMI event subscription in your network
  level: high

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-endpoint-winevent-sysmon-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='event_id:("19" OR "20" OR "21")')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()