[Osquery_manager] WMI artifacts saved query

[tomsonpl]

WMI Persistence Event Subscriptions

Summary

This PR adds an osquery saved query to detect WMI Event Subscription persistence (MITRE ATT&CK T1546.003) on Windows systems. WMI eventing is a powerful persistence mechanism that allows attackers to execute arbitrary commands or scripts when specific system events occur, making it difficult to detect without specialized tooling.

The query provides complete forensic visibility by detecting:

• Bound subscriptions - Active persistence (filter + consumer + binding)
• Orphaned components - Residual artifacts from partially removed malware

Results are enriched with file hashes and code signatures for referenced executables and scripts.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	WMI Event Subscriptions	✅	Windows	wmi_persistence_event_subscriptions_windows_elastic	40033716	Detects WMI persistence including bound subscriptions and orphaned components

MITRE ATT&CK Coverage

Technique ID	Technique Name	Tactic
T1546.003	Event Triggered Execution: Windows Management Instrumentation Event Subscription	Persistence (TA0003)

Queries by Platform

---

🪟 Windows - WMI Event Subscription Persistence Detection

Description

Detects WMI event subscriptions used for persistence (MITRE ATT&CK T1546.003). Includes bound subscriptions (active persistence) AND orphaned components (filters/consumers without bindings) which may indicate residual or partially removed malware. WMI eventing allows attackers to execute arbitrary commands or scripts when specific system events occur. Enriched with file hashes and code signatures for referenced executables and scripts.

Detection Focus:

• Bound subscriptions - Complete filter-consumer chains indicating active persistence
• CommandLineEventConsumer - Executes arbitrary commands/executables on trigger
• ActiveScriptEventConsumer - Executes VBScript/JScript on trigger
• Orphaned consumers - Consumers without bindings (possible residual malware)
• Orphaned filters - Filters without bindings (possible residual malware)
• File hash enrichment - MD5/SHA256 for referenced executables
• Code signature verification - Authenticode validation for executables

Result

Query returns WMI subscription components with their relationships and enrichment data:

Status	Description
bound	Active persistence - filter and consumer are linked
orphaned_consumer	Consumer exists without binding (residual malware artifact)
orphaned_filter	Filter exists without binding (residual malware artifact)

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

wmi_persistence_event_subscriptions_windows_elastic

ECS Field Mappings

Event Context:

• event.category → ["configuration"]
• event.type → ["info"]
• event.kind → "state"
• event.module → "osquery"
• event.dataset → "osquery.wmi_persistence"
• host.os.type → "windows"

Process/Executable Fields:

• process.command_line → command_line_template
• process.executable → executable_path
• process.hash.md5 → md5
• process.hash.sha256 → sha256
• process.code_signature.subject_name → signature_signer
• process.code_signature.status → signature_status

File Fields:

• file.path → script_file_name

Threat Context:

• threat.framework → "MITRE ATT&CK"
• threat.tactic.id → ["TA0003"]
• threat.tactic.name → ["Persistence"]
• threat.technique.id → ["T1546.003"]
• threat.technique.name → ["Event Triggered Execution: Windows Management Instrumentation Event Subscription"]

Tags:

• osquery, persistence, wmi, event_subscription, mitre_t1546_003, windows

SQL Query

-- WMI Persistence Event Subscriptions - Complete Coverage (T1546.003)
-- Detects bound subscriptions and orphaned components for full forensic visibility
-- Fixed: Uses relative_path for proper JOIN matching per osquery schema

WITH wmi_subscriptions AS (
    -- Part 1: Bound subscriptions (complete filter-consumer chains)
    SELECT
        'bound' AS status,
        filter.name AS filter_name,
        filter.query AS filter_query,
        filter.query_language,
        filter.class AS filter_class,
        COALESCE(cli.name, script.name) AS consumer_name,
        CASE
            WHEN cli.name IS NOT NULL THEN 'CommandLineEventConsumer'
            WHEN script.name IS NOT NULL THEN 'ActiveScriptEventConsumer'
            ELSE 'Unknown'
        END AS consumer_type,
        COALESCE(cli.class, script.class) AS consumer_class,
        COALESCE(cli.relative_path, script.relative_path) AS consumer_relative_path,
        cli.command_line_template,
        cli.executable_path,
        script.scripting_engine,
        script.script_file_name,
        script.script_text,
        COALESCE(
            NULLIF(cli.executable_path, ''),
            NULLIF(cli.command_line_template, ''),
            NULLIF(script.script_file_name, '')
        ) AS hashable_path
    FROM wmi_filter_consumer_binding binding
    LEFT JOIN wmi_event_filters filter ON binding.filter = filter.relative_path
    LEFT JOIN wmi_cli_event_consumers cli ON binding.consumer = cli.relative_path
    LEFT JOIN wmi_script_event_consumers script ON binding.consumer = script.relative_path

    UNION ALL

    -- Part 2: Orphaned CLI consumers (possible residual malware)
    SELECT
        'orphaned_consumer' AS status,
        '' AS filter_name,
        '' AS filter_query,
        '' AS query_language,
        '' AS filter_class,
        cli.name AS consumer_name,
        'CommandLineEventConsumer' AS consumer_type,
        cli.class AS consumer_class,
        cli.relative_path AS consumer_relative_path,
        cli.command_line_template,
        cli.executable_path,
        '' AS scripting_engine,
        '' AS script_file_name,
        '' AS script_text,
        COALESCE(NULLIF(cli.executable_path, ''), NULLIF(cli.command_line_template, '')) AS hashable_path
    FROM wmi_cli_event_consumers cli
    WHERE NOT EXISTS (
        SELECT 1 FROM wmi_filter_consumer_binding binding
        WHERE binding.consumer = cli.relative_path
    )

    UNION ALL

    -- Part 3: Orphaned Script consumers (possible residual malware)
    SELECT
        'orphaned_consumer' AS status,
        '' AS filter_name,
        '' AS filter_query,
        '' AS query_language,
        '' AS filter_class,
        script.name AS consumer_name,
        'ActiveScriptEventConsumer' AS consumer_type,
        script.class AS consumer_class,
        script.relative_path AS consumer_relative_path,
        '' AS command_line_template,
        '' AS executable_path,
        script.scripting_engine,
        script.script_file_name,
        script.script_text,
        NULLIF(script.script_file_name, '') AS hashable_path
    FROM wmi_script_event_consumers script
    WHERE NOT EXISTS (
        SELECT 1 FROM wmi_filter_consumer_binding binding
        WHERE binding.consumer = script.relative_path
    )

    UNION ALL

    -- Part 4: Orphaned filters (possible residual malware)
    SELECT
        'orphaned_filter' AS status,
        filter.name AS filter_name,
        filter.query AS filter_query,
        filter.query_language,
        filter.class AS filter_class,
        '' AS consumer_name,
        '' AS consumer_type,
        '' AS consumer_class,
        '' AS consumer_relative_path,
        '' AS command_line_template,
        '' AS executable_path,
        '' AS scripting_engine,
        '' AS script_file_name,
        '' AS script_text,
        '' AS hashable_path
    FROM wmi_event_filters filter
    WHERE NOT EXISTS (
        SELECT 1 FROM wmi_filter_consumer_binding binding
        WHERE binding.filter = filter.relative_path
    )
)

SELECT
    ws.status,
    ws.filter_name,
    ws.filter_query,
    ws.query_language,
    ws.filter_class,
    ws.consumer_name,
    ws.consumer_type,
    ws.consumer_class,
    ws.consumer_relative_path,
    ws.command_line_template,
    ws.executable_path,
    ws.scripting_engine,
    ws.script_file_name,
    ws.script_text,
    h.md5,
    h.sha256,
    a.subject_name AS signature_signer,
    a.result AS signature_status
FROM wmi_subscriptions ws
LEFT JOIN hash h ON h.path = ws.hashable_path AND ws.hashable_path != ''
LEFT JOIN authenticode a ON a.path = ws.hashable_path AND ws.hashable_path != ''

[calladoum-elastic]

minor comment, otherwise lgtm

[calladoum-elastic]

h.sha1 is missing. Is that on purpose?
#16059 exposed the 3 (i.e. md5/sha1/sha256)

[ferullo]

I don't think this is the same file that all the other file.* fields correspond to. I think they all correspond to process.* info, right? It feels like this needs to be addressed somehow. Do we need the script_file_name mapped to ECS? If not could the process.* and file.* fielsets be merged?

[tomsonpl]

Good idea, let me keep these fields unmapped for forensics purposes, so in the end we're end up with having just one namespace - file.

Would this work for you?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b494e12

History

• 💚 Build #36013 succeeded df825cb
• 💚 Build #35317 succeeded 8b3bcfa
• 💚 Build #35218 succeeded bd68b93
• 💚 Build #35040 succeeded d8f08b1