Elastic Defend high stable eql

Suspicious WMI Event Consumer Subscription

WMI Event Consumers can be used by malware for file-less persistence, and are rare otherwise.

View Source

Detection Logic

api where

process.Ext.api.summary like "IWbemServices::PutInstance*FilterToConsumerBinding*" and

not (
 process.code_signature.trusted == true and
 process.code_signature.subject_name in ("HP Inc.", "HP Inc") and
 process.Ext.api.parameters.consumer_type == "CommandLineEventConsumer"
)

Field Validations

Loading…

Comments (0)

Loading comments...