detect-impacket-wmipersist

id: 34167b0d-f295-4b30-8555-d8fa6990cde5
name: detect-impacket-wmipersist
description: |
  This query looks for signs of impacket wmipersist usage and should work for other wmi based persistence methods. Requires analysis.
  Author: Jouni Mikkola
  More info: https://threathunt.blog/impacket-part-2/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
tactics:
- Persistence
relevantTechniques:
  - T1546.003
query: |
  let LookupTime = 30d; 
  DeviceEvents 
  | where Timestamp > ago(LookupTime) 
  | where ActionType == "WmiBindEventFilterToConsumer" 
  | where AdditionalFields contains "ActiveScriptEventConsumer" 
  | extend Consumer = extractjson("$.Consumer", AdditionalFields, typeof(string)),ESS = extractjson("$.ESS", AdditionalFields, typeof(string)), Namespace = extractjson("$.Namespace", AdditionalFields, typeof(string)), PossibleCause = extractjson("$.PossibleCause", AdditionalFields, typeof(string)) 
  | extend ScriptText = extract(@'\ScriptText = (.*;)',1,PossibleCause), ScriptingEngine = extract(@'\ScriptingEngine = (.*;)',1,PossibleCause) 
  | project-reorder Timestamp, DeviceName, Consumer, Namespace, ScriptingEngine, ScriptText