WMI: Destination System Artifacts
Last updated
Was this helpful?
Last updated
Was this helpful?
security.evtx
Source IP/Logon User Name
Logon User Name
Logon by a user with administrative rights
Microsoft-Windows-WMI-Activity%4Operational.evtx
Event ID 5857
Indicates time of wmiprvse execution and path to provider DLL – attackers sometimes install malicious WMI provider DLLs.
Event IDs 5860/5861
Registration of Temporary (5860) and Permanent (5861) Event Consumers. Typically used for persistence, but can be used for remote execution.
Analyzing WMI (Windows Management Instrumentation) destination system artifacts is an essential aspect of investigating sophisticated cyber attacks. WMI can be utilized for legitimate administrative purposes but also exploited by attackers for persistence, lateral movement, and execution of malicious payloads with minimal forensic footprint. Understanding the artifacts associated with WMI activities on the destination system is critical for detecting and responding to such threats.
Security.evtx
Event ID 4624 (Logon Type 3): Indicates a network logon event, which could be related to remote WMI access. Pay attention to the source IP and logon username to identify potential unauthorized access.
Event ID 4672: Signifies special privileges assigned to a new logon session, often associated with administrative rights. An attacker leveraging WMI might use an account with elevated privileges to execute commands or deploy malware.
Microsoft-Windows-WMI-Activity%4Operational.evtx
Event ID 5857: Shows wmiprvse.exe execution details, including the path to the provider DLL. Monitoring for unusual or unexpected provider DLLs can help identify malicious WMI activities.
Event IDs 5860/5861: Indicate the registration of temporary and permanent WMI event consumers, respectively. These are often used for persistence mechanisms by attackers and can occasionally be used for remote command execution.
ShimCache (SYSTEM): Contains execution history of critical binaries such as scrcons.exe, mofcomp.exe, wmiprvse.exe, and potentially malicious executables (evil.exe). This can provide early hints of WMI or PowerShell-based attacks.
AmCache.hve: Logs the first time execution of binaries, providing a timeline for when potentially malicious files (evil.exe, wmiprvse.exe, mofcomp.exe, scrcons.exe) were first run on the system.
File Creation: The presence of uncommon executables (evil.exe) or MOF files (evil.mof) in the file system can indicate malicious use. MOF files, in particular, are associated with managing the WMI Repository and can be compiled using mofcomp.exe to introduce malicious WMI event consumers.
Prefetch: The Prefetch folder (C:\Windows\Prefetch) contains files like mstsc.exe-{hash}.pf, which can indicate remote desktop usage, potentially related to lateral movement or remote execution activities.
WMI Repository: Unauthorized changes within the WMI Repository directory (C:\Windows\System32\wbem\Repository) can signal tampering or the introduction of malicious WMI objects. Monitoring for unexpected modifications or new files in this directory is crucial.
PowerShell commands can be leveraged to inspect the WMI Repository and identify suspicious objects or activities:
– C:\Windows\Prefetch