mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
58 lines
2.6 KiB
Markdown
58 lines
2.6 KiB
Markdown
# Standards and References - WMI Event Subscription Persistence
|
|
|
|
## MITRE ATT&CK References
|
|
|
|
| Technique | Name | Description |
|
|
|-----------|------|-------------|
|
|
| T1546.003 | WMI Event Subscription | Primary persistence technique |
|
|
| T1047 | WMI | WMI execution for lateral movement |
|
|
| T1059.005 | Visual Basic | VBScript in ActiveScriptEventConsumer |
|
|
| T1059.007 | JavaScript | JScript in ActiveScriptEventConsumer |
|
|
|
|
## WMI Subscription Components
|
|
|
|
| Component | WMI Class | Purpose |
|
|
|-----------|-----------|---------|
|
|
| Event Filter | __EventFilter | Defines the trigger (WQL query) |
|
|
| Event Consumer | __EventConsumer | Defines the action |
|
|
| Binding | __FilterToConsumerBinding | Links filter to consumer |
|
|
|
|
## Consumer Types and Risk
|
|
|
|
| Consumer Class | Risk Level | Description |
|
|
|---------------|-----------|-------------|
|
|
| ActiveScriptEventConsumer | Critical | Executes VBScript/JScript code |
|
|
| CommandLineEventConsumer | Critical | Executes arbitrary commands |
|
|
| LogFileEventConsumer | Low | Writes to a log file |
|
|
| NTEventLogEventConsumer | Low | Writes to Windows Event Log |
|
|
| SMTPEventConsumer | Medium | Sends email notifications |
|
|
|
|
## Common Malicious Filter Queries
|
|
|
|
| Filter Type | WQL Query | Usage |
|
|
|-------------|-----------|-------|
|
|
| Process Start | SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' | Execute on specific process start |
|
|
| System Startup | SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' | Execute shortly after boot |
|
|
| Timer-Based | SELECT * FROM __TimerEvent WHERE TimerID='MyTimer' | Execute at intervals |
|
|
| User Logon | SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_LogonSession' | Execute on user logon |
|
|
|
|
## Detection Events
|
|
|
|
| Source | Event ID | Description |
|
|
|--------|----------|-------------|
|
|
| Sysmon | 19 | WmiEventFilter activity detected |
|
|
| Sysmon | 20 | WmiEventConsumer activity detected |
|
|
| Sysmon | 21 | WmiEventConsumerToFilter activity detected |
|
|
| WMI-Activity | 5861 | WMI permanent event subscription created |
|
|
| Security | 4688 | Process creation (mofcomp.exe, WmiPrvSe.exe children) |
|
|
|
|
## Known APT Usage
|
|
|
|
| Group | Technique Details |
|
|
|-------|-------------------|
|
|
| APT29 | ActiveScriptEventConsumer with encoded VBScript backdoor |
|
|
| APT32 (OceanLotus) | WMI subscription for persistence in targeted attacks |
|
|
| FIN8 | CommandLineEventConsumer for PowerShell execution |
|
|
| Turla | WMI event subscription combined with COM hijacking |
|
|
| HEXANE | WMI persistence in Middle Eastern energy sector attacks |
|