kevmap

Techniques › T1546 › T1546.003

T1546.003 Windows Management Instrumentation Event Subscription

privilege escalation · persistence — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
12
Sigma rules tagged attack.t1546.003
0
KEV CVEs mapped here
<p>Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.</p><p>Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may also compile WMI scripts – using mofcomp.exe –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.</p><p>WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.003

WMI Persistence - Command Line Event Consumer hightest
Author: Thomas Patzke · 2018-03-07 (modified 2021-11-27) · logsource: product=windows category=image_load · 05936ce2-ee05-4dae-9d03-9a391cf2d2c6
Detects WMI command line event consumers
Techniques: T1546.003
WMI Persistence mediumtest
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community · 2017-08-22 (modified 2022-02-10) · logsource: product=windows service=wmi · 0b7889b4-5577-4521-a60a-3376ee7f9f7b
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Techniques: T1546.003
WMI Event Subscription mediumtest
Author: Tom Ueltschi (@c_APT_ure) · 2019-01-12 (modified 2021-11-27) · logsource: product=windows category=wmi_event · 0f06a3a5-6a09-413f-8743-e6cf35561297
Detects creation of WMI event subscription persistence method
Techniques: T1546.003
WMI Persistence - Script Event Consumer File Write hightest
Author: Thomas Patzke · 2018-03-07 (modified 2021-11-27) · logsource: product=windows category=file_event · 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
Detects file writes of WMI script event consumer
Techniques: T1546.003
WMI Backdoor Exchange Transport Agent criticaltest
Author: Florian Roth (Nextron Systems) · 2019-10-11 (modified 2023-02-08) · logsource: product=windows category=process_creation · 797011dc-44f4-4e6f-9f10-a8ceefbe566b
Detects a WMI backdoor in Exchange Transport Agents via WMI event filters
Techniques: T1546.003
Suspicious Encoded Scripts in a WMI Consumer hightest
Author: Florian Roth (Nextron Systems) · 2021-09-01 (modified 2022-10-09) · logsource: product=windows category=wmi_event · 83844185-1c5b-45bc-bcf3-b5bf3084ca5b
Detects suspicious encoded payloads in WMI Event Consumers
Techniques: T1047T1546.003
Potential Remote WMI ActiveScriptEventConsumers Activity mediumtest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-09-02 (modified 2024-09-02) · logsource: product=windows service=security · 9599c180-e3a8-4743-8f92-7fb96d3be648
Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
Techniques: T1546.003
Powershell WMI Persistence mediumtest
Author: frack113 · 2021-08-19 (modified 2022-12-25) · logsource: product=windows category=ps_script · 9e07f6e7-83aa-45c6-998e-0af26efd0a85
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.
Techniques: T1546.003
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load mediumtest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-09-02 (modified 2023-02-22) · logsource: product=windows category=image_load · b439f47d-ef52-4b29-9a2f-57d8a96cb6b8
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Techniques: T1546.003
NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE hightest
Author: Florian Roth (Nextron Systems) · 2021-06-25 (modified 2026-06-19) · logsource: product=windows category=process_creation · ebef4391-1a81-4761-a40a-1db446c0e625
Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.
Techniques: T1546.003
WMI Persistence - Script Event Consumer mediumtest
Author: Thomas Patzke · 2018-03-07 (modified 2022-10-11) · logsource: product=windows category=process_creation · ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e
Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.
Techniques: T1546.003
WMI Persistence - Security mediumtest
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community · 2017-08-22 (modified 2022-11-29) · logsource: product=windows service=security · f033f3f3-fd24-4995-97d8-a3bb17550a88
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Techniques: T1546.003

Rules tagged at the parent level (attack.t1546) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

COM Hijack via Sdclt hightest
Author: Omkar Gudhate · 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Techniques: T1546T1548
Control Panel Items hightest
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Techniques: T1218.002T1546
Suspicious Get-Variable.exe Creation hightest
Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Techniques: T1546T1027
Suspicious Outlook Macro Created hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Techniques: T1137T1008T1546
MSSQL Extended Stored Procedure Backdoor Maggie hightest
Author: Denis Szadkowski, DIRT / DCSO CyTec · 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Techniques: T1546
SOURGUM Actor Behaviours hightest
Author: MSTIC, FPT.EagleEye · 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Techniques: T1546T1546.015
New Outlook Macro Created mediumtest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
HAFNIUM Exchange Exploitation Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Techniques: T1546T1053
Outlook Macro Execution Without Warning Setting Enabled hightest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Techniques: T1137T1008T1546