From asi
Detects WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 logs for WmiPrvSE.exe child processes, remote execution, and event subscription persistence.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Windows Management Instrumentation (WMI) is commonly abused for lateral movement via `wmic process call create` or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) f...
Hunts WMI-based lateral movement by parsing Windows Event 4688, Sysmon Event 1, and WMI logs for WmiPrvSE.exe children, remote execution, and persistence. For SOC threat hunting.
Detects WMI-based lateral movement by analyzing Windows event ID 4688 process creations, Sysmon ID 1 WmiPrvSE.exe child processes, remote executions, and event subscription persistence in logs.
Detects WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, 21 for malicious EventFilters, Consumers, and Bindings. For threat hunting and incident response on Windows.
Share bugs, ideas, or general feedback.
Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.
python-evtx, lxml librariesExtract Event ID 4688 and Sysmon Event 1 entries from EVTX files.
Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.
Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).
Parse WMI-Activity/Operational log for event consumer creation indicating persistence.
JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.