Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » Knowledge Base » Tech Topics and Techniques Knowledge Base » Windows » Windows Code Snippets » Persistence Modules (KB)
Owner: User #71468
WMI Event Persistence (PSEDWMIEvent_SU - SystemUptime)
SECRET//NOFORN
OSB Library: Persistence
Module Name: PSEDWMIEvent_SU (SystemUptime)
Module Description: This module creates a persisted WMIWindows Management Instrumentation event that executes a command upon trigger of the system's uptime being between a given range in seconds. The event will trigger only once. The following is the WQL query used, with the passed parameters in parenthesis:
SELECT * FROM __InstanceModificationEvent WITHIN (polling interval) WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= (minimum uptime) AND TargetInstance.SystemUpTime < (minimum uptime + polling interval)
PSP/OS Issues: No known issues
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house
Notes:
- Module uses COM and requires being run as admin to succeed
- Too low of a minimum uptime value can cause event to not trigger due to boot initialization
- Too small of a polling interval could potentially reduce system performance
SECRET//NOFORN