feat: add 5 new cybersecurity skills - WMI persistence, CloudTrail forensics, honeypots, PDF malware, DCSync detection

2026-07-20 14:30:59 +03:00 · 2026-03-11 00:42:59 +01:00
parent 466f37bfb6
commit 679c98b339
20 changed files with 2112 additions and 0 deletions
@@ -0,0 +1,89 @@
+# WMI Persistence Detection Reference
+
+## Sysmon Event IDs
+
+| Event ID | Type | Description |
+|----------|------|-------------|
+| 19 | WmiEventFilter | Logs WMI EventFilter creation with WQL query |
+| 20 | WmiEventConsumer | Logs WMI EventConsumer creation (command/script) |
+| 21 | WmiEventConsumerToFilter | Logs binding of EventFilter to EventConsumer |
+
+## Sysmon Configuration
+
+Enable WMI event logging in sysmonconfig.xml:
+
+```xml
+<RuleGroup groupRelation="or">
+  <WmiEvent onmatch="include">
+    <Operation condition="is">Created</Operation>
+  </WmiEvent>
+</RuleGroup>
+```
+
+Install: `sysmon64.exe -accepteula -i sysmonconfig.xml`
+
+## PowerShell WMI Enumeration
+
+```powershell
+# List all EventFilters
+Get-WmiObject -Namespace root\subscription -Class __EventFilter
+
+# List all EventConsumers
+Get-WmiObject -Namespace root\subscription -Class __EventConsumer
+
+# List all Bindings
+Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding
+
+# Remove specific subscription
+Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter "Name='MalFilter'" | Remove-WmiObject
+Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -Filter "Name='MalConsumer'" | Remove-WmiObject
+Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like '*MalFilter*'} | Remove-WmiObject
+```
+
+## Suspicious Consumer Types
+
+| Consumer Class | Risk | Description |
+|---------------|------|-------------|
+| CommandLineEventConsumer | Critical | Executes arbitrary system commands |
+| ActiveScriptEventConsumer | Critical | Runs embedded VBScript or JScript |
+| LogFileEventConsumer | Low | Writes to log file |
+| NTEventLogEventConsumer | Low | Creates Windows event log entry |
+| SMTPEventConsumer | Medium | Sends email notification |
+
+## Splunk Detection Query
+
+```spl
+index=sysmon EventCode IN (19, 20, 21)
+| eval event_type=case(EventCode=19, "EventFilter", EventCode=20, "EventConsumer", EventCode=21, "Binding")
+| where Consumer_Type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer")
+| stats count by Computer, event_type, Consumer_Type, Destination, User
+| where count > 0
+```
+
+## Elastic Detection Rule
+
+```json
+{
+  "rule": {
+    "name": "WMI Persistence via Event Subscription",
+    "query": "event.code:(\"19\" OR \"20\" OR \"21\") AND winlog.event_data.EventType:\"WmiConsumerEvent\" AND winlog.event_data.Type:(\"CommandLineEventConsumer\" OR \"ActiveScriptEventConsumer\")",
+    "severity": "high",
+    "risk_score": 73,
+    "tags": ["ATT&CK T1546.003"]
+  }
+}
+```
+
+## MITRE ATT&CK Mapping
+
+- **Technique**: T1546.003 - Event Triggered Execution: WMI Event Subscription
+- **Tactic**: Persistence, Privilege Escalation
+- **Data Sources**: WMI Objects (WMI Creation), Command Execution, Process Creation
+
+## Autoruns WMI Tab
+
+```cmd
+autorunsc64.exe -accepteula -w -nobanner -c
+```
+
+Output includes WMI subscriptions under "WMI" category with filter name, consumer, and command details.