Skip to content

Hide Navigation Hide TOC

Suspicious Scripting in a WMI Consumer (fe21810c-2a8c-478f-8dd3-5a287fb2a0e0)

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Scripting in a WMI Consumer (fe21810c-2a8c-478f-8dd3-5a287fb2a0e0) Sigma-Rules Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern 1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2