prsstn-wmi-sbscrp

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

インストールへ移動

リポジトリ: Undermybelt/hermes-skills
ソースの最終更新活動: 2026年6月7日 07:23
検出された SKILL.md の言語: 英語
スター: 6
フォーク: 1

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/Undermybelt/hermes-skills --skill prsstn-wmi-sbscrp

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

8 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

このリポジトリのすべてを見る

Hunting for Persistence via WMI Subscriptions

When to Use

When proactively searching for fileless persistence mechanisms in Windows environments

After threat intelligence reports indicate WMI-based persistence by APT groups (APT29, APT32, FIN8)

When investigating systems where malware persists across reboots despite cleanup attempts

During incident response when standard persistence locations (Run keys, scheduled tasks) are clean

When WmiPrvSe.exe is observed spawning unexpected child processes

Prerequisites

Sysmon Event ID 19, 20, 21 (WMI Event Filter/Consumer/Binding) enabled

Windows Event ID 5861 (WMI activity logging) from Microsoft-Windows-WMI-Activity

PowerShell logging enabled (Script Block Logging, Module Logging)

WMI repository access for enumeration

SIEM platform for event correlation

Workflow

Enumerate Existing WMI Subscriptions: Query all permanent WMI event subscriptions on target systems. A clean system typically has very few or zero permanent subscriptions, making anomalies easy to spot.

Monitor WMI Event Creation (Sysmon 19/20/21): Sysmon Event 19 captures WmiEventFilter activity, Event 20 captures WmiEventConsumer activity, and Event 21 captures WmiEventConsumerToFilter binding.

Analyze Consumer Types: Focus on ActiveScriptEventConsumer (runs VBScript/JScript) and CommandLineEventConsumer (executes commands) -- these are the dangerous types used for persistence.

Check Event Filter Triggers: Examine what triggers the subscription. Common malicious triggers include system startup (Win32_ProcessStartTrace), user logon, or timer-based execution intervals.

Investigate WmiPrvSe.exe Child Processes: When a WMI subscription fires, the action is executed by WmiPrvSe.exe. Hunt for unusual child processes of WmiPrvSe.exe.

Correlate with MOF Compilation: Detect mofcomp.exe usage which compiles MOF files to create WMI subscriptions programmatically.

Validate and Respond: Confirm malicious subscriptions, remove them, and trace back to the initial infection vector.

Key Concepts

Concept

Description

T1546.003

Event Triggered Execution: WMI Event Subscription

__EventFilter

WMI class defining the trigger condition

Hunting for Persistence via WMI Subscriptions

When to Use

When proactively searching for fileless persistence mechanisms in Windows environments

After threat intelligence reports indicate WMI-based persistence by APT groups (APT29, APT32, FIN8)

When investigating systems where malware persists across reboots despite cleanup attempts

During incident response when standard persistence locations (Run keys, scheduled tasks) are clean

When WmiPrvSe.exe is observed spawning unexpected child processes

Prerequisites

Sysmon Event ID 19, 20, 21 (WMI Event Filter/Consumer/Binding) enabled

Windows Event ID 5861 (WMI activity logging) from Microsoft-Windows-WMI-Activity

PowerShell logging enabled (Script Block Logging, Module Logging)

WMI repository access for enumeration

SIEM platform for event correlation

Workflow

Analyze Consumer Types: Focus on ActiveScriptEventConsumer (runs VBScript/JScript) and CommandLineEventConsumer (executes commands) -- these are the dangerous types used for persistence.

Check Event Filter Triggers: Examine what triggers the subscription. Common malicious triggers include system startup (Win32_ProcessStartTrace), user logon, or timer-based execution intervals.

Investigate WmiPrvSe.exe Child Processes: When a WMI subscription fires, the action is executed by WmiPrvSe.exe. Hunt for unusual child processes of WmiPrvSe.exe.

Correlate with MOF Compilation: Detect mofcomp.exe usage which compiles MOF files to create WMI subscriptions programmatically.

Validate and Respond: Confirm malicious subscriptions, remove them, and trace back to the initial infection vector.

Key Concepts

Concept

Description

T1546.003

Event Triggered Execution: WMI Event Subscription

__EventFilter

WMI class defining the trigger condition

name	prsstn-wmi-sbscrp
description	Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","wmi-persistence","mitre-t1546-003","event-subscription","windows","endpoint-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

name	prsstn-wmi-sbscrp
description	Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","wmi-persistence","mitre-t1546-003","event-subscription","windows","endpoint-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

prsstn-wmi-sbscrp

インストール方法

ソースファイルを確認

Hunting for Persistence via WMI Subscriptions

When to Use

Prerequisites

Workflow

Key Concepts

Hunting for Persistence via WMI Subscriptions

When to Use

Prerequisites

Workflow

Key Concepts

Detection Queries

Splunk -- WMI Subscription Creation via Sysmon

Splunk -- WMI Subscription via Windows Event 5861

PowerShell -- Enumerate WMI Subscriptions

KQL -- WmiPrvSe.exe Spawning Suspicious Children

Sigma Rule

Common Scenarios

Output Format

prsstn-wmi-sbscrp

ソース情報

インストール方法

ソースファイルを確認

このリポジトリの他の Skills

Hunting for Persistence via WMI Subscriptions

When to Use

Prerequisites

Workflow

Key Concepts

このリポジトリの他の Skills

Hunting for Persistence via WMI Subscriptions

When to Use

Prerequisites

Workflow

Key Concepts

Detection Queries

Splunk -- WMI Subscription Creation via Sysmon

Splunk -- WMI Subscription via Windows Event 5861

PowerShell -- Enumerate WMI Subscriptions

KQL -- WmiPrvSe.exe Spawning Suspicious Children

Sigma Rule

Common Scenarios

Output Format