detect-impacket-wmipersist

Hunt Hypothesis

Adversaries may use Impacket’s wmiPersist method to establish persistent access to a Windows system via WMI, allowing long-term command and control. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential persistence mechanisms used by advanced threats.

KQL Query

let LookupTime = 30d; 
DeviceEvents 
| where Timestamp > ago(LookupTime) 
| where ActionType == "WmiBindEventFilterToConsumer" 
| where AdditionalFields contains "ActiveScriptEventConsumer" 
| extend Consumer = extractjson("$.Consumer", AdditionalFields, typeof(string)),ESS = extractjson("$.ESS", AdditionalFields, typeof(string)), Namespace = extractjson("$.Namespace", AdditionalFields, typeof(string)), PossibleCause = extractjson("$.PossibleCause", AdditionalFields, typeof(string)) 
| extend ScriptText = extract(@'\ScriptText = (.*;)',1,PossibleCause), ScriptingEngine = extract(@'\ScriptingEngine = (.*;)',1,PossibleCause) 
| project-reorder Timestamp, DeviceName, Consumer, Namespace, ScriptingEngine, ScriptText

Analytic Rule Definition

id: 34167b0d-f295-4b30-8555-d8fa6990cde5
name: detect-impacket-wmipersist
description: |
  This query looks for signs of impacket wmipersist usage and should work for other wmi based persistence methods. Requires analysis.
  Author: Jouni Mikkola
  More info: https://threathunt.blog/impacket-part-2/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
tactics:
- Persistence
relevantTechniques:
  - T1546.003
query: |
  let LookupTime = 30d; 
  DeviceEvents 
  | where Timestamp > ago(LookupTime) 
  | where ActionType == "WmiBindEventFilterToConsumer" 
  | where AdditionalFields contains "ActiveScriptEventConsumer" 
  | extend Consumer = extractjson("$.Consumer", AdditionalFields, typeof(string)),ESS = extractjson("$.ESS", AdditionalFields, typeof(string)), Namespace = extractjson("$.Namespace", AdditionalFields, typeof(string)), PossibleCause = extractjson("$.PossibleCause", AdditionalFields, typeof(string)) 
  | extend ScriptText = extract(@'\ScriptText = (.*;)',1,PossibleCause), ScriptingEngine = extract(@'\ScriptingEngine = (.*;)',1,PossibleCause) 
  | project-reorder Timestamp, DeviceName, Consumer, Namespace, ScriptingEngine, ScriptText

Required Data Sources

MITRE ATT&CK Context

• Tactic: Persistence
• Technique: T1546.003 — T1546.003

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Persistence/detect-impacket-wmipersist.yaml)

False Positive Guidance

• Scenario: Legitimate WMI Persistence for Software Deployment
  Description: A system administrator uses wmipersist to deploy a legitimate software update across the network.
  Filter/Exclusion: Check for known enterprise software deployment tools (e.g., Microsoft System Center Configuration Manager, SCCM) and filter by known deployment scripts or tasks.

• Scenario: Scheduled Task Creation via WMI
  Description: An admin creates a scheduled task using WMI to run a maintenance script, such as disk cleanup or log rotation.
  Filter/Exclusion: Filter by task names containing keywords like “maintenance”, “cleanup”, or “backup”, and check for execution paths within known enterprise directories (e.g., C:\Windows\System32\tasks).

• Scenario: WMI-Based Remote Management Tool Usage
  Description: A security tool like PsExec or WinRM is used to remotely manage systems, and the tool leverages WMI for communication.
  Filter/Exclusion: Check for known remote management tools and their associated command-line arguments or execution paths. Exclude processes launched from trusted remote management consoles.

• Scenario: WMI Event Subscription for Monitoring
  Description: A monitoring tool subscribes to WMI events to track system performance or security events (e.g., using wmievent or WMI Event Consumer).
  Filter/Exclusion: Filter by event consumer names that match known monitoring tools (e.g., Microsoft.Windows.EventLog or Microsoft.Windows.DNS), and exclude events related to system health or audit logs.

• Scenario: Admin Task to Configure WMI Settings
  Description: An administrator modifies WMI settings via wmiprvse.exe or wbemtest to configure system monitoring or logging.
  Filter/Exclusion: Filter by user accounts with administrative privileges and check for