WMI: Destination System Artifacts

WMI: Destination System Artifacts Quick Reference

Event Log

security.evtx

• Event ID 4624

  • Logon Type 3

  • Source IP/Logon User Name

• Event ID 4672

  • Logon User Name

  • Logon by a user with administrative rights

Microsoft-Windows-WMI-Activity%4Operational.evtx

• Event ID 5857

  • Indicates time of wmiprvse execution and path to provider DLL – attackers sometimes install malicious WMI provider DLLs.

• Event IDs 5860/5861

  • Registration of Temporary (5860) and Permanent (5861) Event Consumers. Typically used for persistence, but can be used for remote execution.

Registry

• ShimCache – SYSTEM

  • scrcons.exe

  • mofcomp.exe

  • wmiprvse.exe

  • evil.exe

• AmCache.hve – First Time Executed

  • evil.exe

  • wmiprvse.exe

  • mofcomp.exe

  • scrcons.exe

File System

• File Creation

  • evil.exe

  • evil.mof – .mof files can be used to manage the WMI Repository

• Prefetch – C:\Windows\Prefetch

  • mstsc.exe-{hash}.pf

• Unauthorized changes to the WMI Repository

  • C:\Windows\System32\wbem\Repository

Analyzing WMI (Windows Management Instrumentation) destination system artifacts is an essential aspect of investigating sophisticated cyber attacks. WMI can be utilized for legitimate administrative purposes but also exploited by attackers for persistence, lateral movement, and execution of malicious payloads with minimal forensic footprint. Understanding the artifacts associated with WMI activities on the destination system is critical for detecting and responding to such threats.

Event Logs

1. Security.evtx

   • Event ID 4624 (Logon Type 3): Indicates a network logon event, which could be related to remote WMI access. Pay attention to the source IP and logon username to identify potential unauthorized access.

   • Event ID 4672: Signifies special privileges assigned to a new logon session, often associated with administrative rights. An attacker leveraging WMI might use an account with elevated privileges to execute commands or deploy malware.

2. Microsoft-Windows-WMI-Activity%4Operational.evtx

   • Event ID 5857: Shows wmiprvse.exe execution details, including the path to the provider DLL. Monitoring for unusual or unexpected provider DLLs can help identify malicious WMI activities.

   • Event IDs 5860/5861: Indicate the registration of temporary and permanent WMI event consumers, respectively. These are often used for persistence mechanisms by attackers and can occasionally be used for remote command execution.

Registry Artifacts

• ShimCache (SYSTEM): Contains execution history of critical binaries such as scrcons.exe, mofcomp.exe, wmiprvse.exe, and potentially malicious executables (evil.exe). This can provide early hints of WMI or PowerShell-based attacks.

• AmCache.hve: Logs the first time execution of binaries, providing a timeline for when potentially malicious files (evil.exe, wmiprvse.exe, mofcomp.exe, scrcons.exe) were first run on the system.

File System Artifacts

• File Creation: The presence of uncommon executables (evil.exe) or MOF files (evil.mof) in the file system can indicate malicious use. MOF files, in particular, are associated with managing the WMI Repository and can be compiled using mofcomp.exe to introduce malicious WMI event consumers.

• Prefetch: The Prefetch folder (C:\Windows\Prefetch) contains files like mstsc.exe-{hash}.pf, which can indicate remote desktop usage, potentially related to lateral movement or remote execution activities.

• WMI Repository: Unauthorized changes within the WMI Repository directory (C:\Windows\System32\wbem\Repository) can signal tampering or the introduction of malicious WMI objects. Monitoring for unexpected modifications or new files in this directory is crucial.

Investigating with PowerShell

PowerShell commands can be leveraged to inspect the WMI Repository and identify suspicious objects or activities:

# List all WMI Permanent Event Consumers
Get-WmiObject -Namespace root\Subscription -Class __EventConsumer

# Investigate specific MOF files compiled into the WMI Repository
Get-WmiObject -Namespace root\Default -Query "SELECT * FROM __MOFClass WHERE FileName = 'evil.mof'"

# Audit the WMI Repository for unauthorized changes
Get-ChildItem -Path C:\Windows\System32\wbem\Repository