Skip to content

Hide Navigation Hide TOC

New ActiveScriptEventConsumer Created Via Wmic.EXE (ebef4391-1a81-4761-a40a-1db446c0e625)

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Cluster A Galaxy A Cluster B Galaxy B Level
New ActiveScriptEventConsumer Created Via Wmic.EXE (ebef4391-1a81-4761-a40a-1db446c0e625) Sigma-Rules Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 2