[metadata]
creation_date = "2020/12/04"
maturity = "production"
updated_date = "2020/12/04"

[rule]
author = ["Elastic"]
description = """
An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and
bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an
event and execute arbitrary code when that event occurs, providing persistence on a system.
"""
index = ["logs-endpoint.events.*", "winlogbeat-*"]
language = "eql"
license = "Elastic License"
name = "Persistence via WMI Event Subscription"
risk_score = 21
rule_id = "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Persistence"]
type = "eql"

query = '''
process where event.type in ("start", "process_started") and
  (process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
  process.args : "create" and
  process.args : ("ActiveScriptEventConsumer", "CommandLineEventConsumer")

'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
