Elastic Defend high stable eql

Execution via WMI CommandLine Event Consumer

Identifies the creation or execution via the Windows Management Instrumentation CommandLine Event Consumer class. The CommandLineEventConsumer class starts an arbitrary process in the local system when an event is delivered to it.

View Source

Detection Logic

process where event.action == "start" and
(
 (process.parent.executable : "?:\\Windows\\Sys*\\wbem\\WmiPrvSE.exe" and
  /* wbemcons.dll - WMI Standard Event Consumers */
  process.parent.thread.Ext.call_stack_summary : "*wbemcons.dll*") or

 (process.pe.original_file_name : "wmic.exe" and process.command_line : "*create*" and process.command_line : "*CommandLineEventConsumer*")
) and
 not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
      process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
 not process.executable : "?:\\Windows\\System32\\chkntfs.exe" and
 not process.hash.sha256 : "c4ecbd9e75fbe2d8ab5f4d94d663207d2b73ec924ba9e27b5df9560818ff1105"

Field Validations

Loading…

Comments (0)

Loading comments...