name: WMI Permanent Event Subscription
id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d
version: 1
date: '2018-10-23'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: This search looks for the creation of WMI permanent event subscriptions.
search: '`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?<consumer>[^;|^$]+)"
  | search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" | stats
  count min(_time) as firstTime max(_time) as lastTime by ComputerName, consumer,
  Message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | rename ComputerName as dest | `wmi_permanent_event_subscription_filter`'
how_to_implement: To successfully implement this search, you must be ingesting the
  Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on
  the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational].
known_false_positives: Although unlikely, administrators may use event subscriptions
  for legitimate purposes.
references: []
tags:
  analytic_story:
  - Suspicious WMI Use
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 5
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1047
  nist:
  - PR.PT
  - PR.AT
  - PR.AC
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Message
  - consumer
  - ComputerName
  security_domain: endpoint
