Skip to content

Instantly share code, notes, and snippets.

@ecapuano

ecapuano/wmi_event_consumer_stacking.txt

Last active May 26, 2022 01:42
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save ecapuano/0da1a2ce6ce57aeaa4e06e33642fccb9 to your computer and use it in GitHub Desktop.
Save ecapuano/0da1a2ce6ce57aeaa4e06e33642fccb9 to your computer and use it in GitHub Desktop.
Download ZIP
wmi_event_consumer_stacking
Raw
wmi_event_consumer_stacking.txt
// run against results from Windows.Persistence.PermanentWMIEvents
// https://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Persistence/PermanentWMIEvents.yaml
SELECT ConsumerDetails.Name AS ConsumerName, ConsumerDetails.CommandLineTemplate AS CommandLineTemplate, FilterDetails.Name AS FilterName, FilterDetails.Query AS FilterQuery, count() AS Count FROM source()
// filter common FPs
WHERE ConsumerName != "BVTConsumer"
AND ConsumerName != "SCM Event Log Consumer"
AND ConsumerName != "DellCommandPowerManagerAlertEventConsumer"
AND ConsumerName != "DellCommandPowerManagerPolicyChangeEventConsumer"
AND ConsumerName != "CmdLineConsumer_WSCEAA"
// end filter common FPs
GROUP BY ConsumerName, CommandLineTemplate, FilterName, FilterQuery // stack
LIMIT 50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment