AN0236
Analytic 0236
Windows
Monitor for creation of WMI EventFilter, EventConsumer, and FilterToConsumerBinding objects through WMI or MOF file execution. Detect command-line execution of `mofcomp.exe`, usage of `Register-WmiEvent` via PowerShell, and anomalous child processes of `WmiPrvSE.exe` that indicate triggered execution. Look for lateral anomalies in process lineage and WMI logging channels.
WinEventLog:WMI
EventCode=5857, 5858, 5860, 5861
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
[TimeWindow]
Defines temporal correlation range between WMI creation and child process execution
[UserContext]
Tune for specific accounts (e.g., SYSTEM or attacker-controlled users)
[ProcessNameAllowlist]
Used to exclude known benign consumers triggered via WMI (e.g., backup tools)
[ParentProcessAnomalyThreshold]
Defines what constitutes anomalous spawning from WmiPrvSE.exe