Skip to content

Hide Navigation Hide TOC

Remote WMI ActiveScriptEventConsumers (9599c180-e3a8-4743-8f92-7fb96d3be648)

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network

Cluster A Galaxy A Cluster B Galaxy B Level
Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern Remote WMI ActiveScriptEventConsumers (9599c180-e3a8-4743-8f92-7fb96d3be648) Sigma-Rules 1
Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern 2