#!/usr/bin/env python3
"""Agent for hunting WMI event subscription persistence (T1546.003)."""

import json
import argparse
import subprocess
import re
from datetime import datetime

WMI_CLASSES = {
    "EventFilter": {
        "wmic_cmd": ["wmic", "/namespace:\\\\root\\subscription", "path", "__EventFilter", "get", "/format:list"],
        "description": "WMI event filters that trigger on system events",
    },
    "EventConsumer": {
        "wmic_cmd": ["wmic", "/namespace:\\\\root\\subscription", "path", "CommandLineEventConsumer", "get", "/format:list"],
        "description": "Command-line consumers that execute when filters trigger",
    },
    "ActiveScriptEventConsumer": {
        "wmic_cmd": ["wmic", "/namespace:\\\\root\\subscription", "path", "ActiveScriptEventConsumer", "get", "/format:list"],
        "description": "Script-based consumers (VBScript/JScript) for WMI persistence",
    },
    "FilterToConsumerBinding": {
        "wmic_cmd": ["wmic", "/namespace:\\\\root\\subscription", "path", "__FilterToConsumerBinding", "get", "/format:list"],
        "description": "Bindings linking event filters to consumers",
    },
}

SUSPICIOUS_WMI_PATTERNS = [
    r"powershell", r"cmd\.exe", r"mshta", r"rundll32",
    r"certutil", r"bitsadmin", r"regsvr32",
    r"base64", r"IEX", r"DownloadString", r"Net\.WebClient",
    r"invoke-expression", r"new-object.*net\.webclient",
    r"\\temp\\", r"\\appdata\\", r"\\users\\public\\",
    r"wscript", r"cscript", r"javascript:", r"vbscript:",
]


def enumerate_wmi_subscriptions():
    """Enumerate all WMI event subscriptions on the local system."""
    results = {"timestamp": datetime.utcnow().isoformat(), "classes": {}, "suspicious": []}
    for class_name, info in WMI_CLASSES.items():
        try:
            proc = subprocess.run(info["wmic_cmd"], capture_output=True, text=True, timeout=15)
            entries = parse_wmic_list(proc.stdout)
            suspicious_entries = []
            for entry in entries:
                entry_text = json.dumps(entry).lower()
                matched = [p for p in SUSPICIOUS_WMI_PATTERNS if re.search(p, entry_text, re.I)]
                if matched:
                    entry["matched_patterns"] = matched
                    suspicious_entries.append(entry)
            results["classes"][class_name] = {
                "description": info["description"],
                "total_entries": len(entries),
                "entries": entries,
            }
            results["suspicious"].extend([{**e, "class": class_name} for e in suspicious_entries])
        except (subprocess.TimeoutExpired, FileNotFoundError):
            results["classes"][class_name] = {"error": "command failed"}
    results["total_suspicious"] = len(results["suspicious"])
    return results


def parse_wmic_list(output):
    """Parse WMIC /format:list output into list of dicts."""
    entries = []
    current = {}
    for line in output.strip().split("\n"):
        line = line.strip()
        if not line:
            if current:
                entries.append(current)
                current = {}
            continue
        if "=" in line:
            key, _, value = line.partition("=")
            current[key.strip()] = value.strip()
    if current:
        entries.append(current)
    return entries


def scan_sysmon_wmi_events(evtx_file):
    """Parse Sysmon EVTX for WMI events (Event IDs 19, 20, 21)."""
    try:
        import Evtx.Evtx as evtx_lib
    except ImportError:
        return {"error": "python-evtx not installed"}
    findings = []
    wmi_event_ids = {"19", "20", "21"}
    with evtx_lib.Evtx(evtx_file) as log:
        for record in log.records():
            xml = record.xml()
            for eid in wmi_event_ids:
                if f"<EventID>{eid}</EventID>" in xml:
                    suspicious = any(re.search(p, xml, re.I) for p in SUSPICIOUS_WMI_PATTERNS)
                    findings.append({
                        "record_id": record.record_num(),
                        "event_id": int(eid),
                        "event_type": {
                            "19": "WmiEventFilter", "20": "WmiEventConsumer", "21": "WmiEventBinding"
                        }[eid],
                        "suspicious": suspicious,
                        "xml_snippet": xml[:800],
                    })
                    break
    return {
        "file": evtx_file,
        "total_wmi_events": len(findings),
        "suspicious_events": sum(1 for f in findings if f["suspicious"]),
        "findings": findings[:300],
    }


def query_powershell_wmi():
    """Use PowerShell Get-WMIObject to enumerate WMI subscriptions."""
    ps_script = """
    $filters = Get-WMIObject -Namespace root\\Subscription -Class __EventFilter | Select Name,Query
    $consumers = Get-WMIObject -Namespace root\\Subscription -Class CommandLineEventConsumer | Select Name,CommandLineTemplate
    $bindings = Get-WMIObject -Namespace root\\Subscription -Class __FilterToConsumerBinding | Select Filter,Consumer
    @{Filters=$filters;Consumers=$consumers;Bindings=$bindings} | ConvertTo-Json -Depth 5
    """
    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_script],
            capture_output=True, text=True, timeout=30
        )
        if result.returncode == 0 and result.stdout.strip():
            return json.loads(result.stdout)
        return {"error": result.stderr[:500]}
    except (subprocess.TimeoutExpired, FileNotFoundError, json.JSONDecodeError) as e:
        return {"error": str(e)}


def main():
    parser = argparse.ArgumentParser(description="Hunt for WMI event subscription persistence")
    sub = parser.add_subparsers(dest="command")
    sub.add_parser("enumerate", help="Enumerate WMI subscriptions via WMIC")
    sub.add_parser("powershell", help="Enumerate via PowerShell Get-WMIObject")
    s = sub.add_parser("sysmon", help="Scan Sysmon EVTX for WMI events (19/20/21)")
    s.add_argument("--evtx-file", required=True)
    args = parser.parse_args()
    if args.command == "enumerate":
        result = enumerate_wmi_subscriptions()
    elif args.command == "powershell":
        result = query_powershell_wmi()
    elif args.command == "sysmon":
        result = scan_sysmon_wmi_events(args.evtx_file)
    else:
        parser.print_help()
        return
    print(json.dumps(result, indent=2, default=str))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
WMI Subscription Persistence Detection Script
Analyzes Sysmon Events 19/20/21 and process creation logs to detect
malicious WMI permanent event subscriptions used for persistence.
"""

import json
import csv
import argparse
import datetime
import re
from pathlib import Path

DANGEROUS_CONSUMER_TYPES = {"ActiveScriptEventConsumer", "CommandLineEventConsumer"}

SUSPICIOUS_FILTER_PATTERNS = [
    (r"__InstanceCreationEvent.*Win32_Process", "process_start_trigger"),
    (r"__InstanceModificationEvent.*Win32_PerfFormattedData", "system_startup_trigger"),
    (r"__TimerEvent", "timer_based_trigger"),
    (r"__InstanceCreationEvent.*Win32_LogonSession", "user_logon_trigger"),
    (r"Win32_ProcessStartTrace", "process_trace_trigger"),
]

SUSPICIOUS_CONSUMER_PATTERNS = [
    (r"(?i)powershell", "powershell_execution"),
    (r"(?i)(cmd\.exe|cmd\s/c)", "command_execution"),
    (r"(?i)(http|https)://", "network_callback"),
    (r"(?i)(wscript|cscript)", "script_execution"),
    (r"(?i)(base64|encodedcommand|-enc\s)", "encoded_content"),
    (r"(?i)(invoke-expression|iex|downloadstring)", "download_cradle"),
]


def parse_events(input_path: str) -> list[dict]:
    """Parse Sysmon WMI event logs."""
    path = Path(input_path)
    events = []
    if path.suffix == ".json":
        with open(path, "r", encoding="utf-8") as f:
            data = json.load(f)
            events = data if isinstance(data, list) else data.get("events", [])
    elif path.suffix == ".csv":
        with open(path, "r", encoding="utf-8-sig") as f:
            events = [dict(row) for row in csv.DictReader(f)]
    return events


def detect_wmi_persistence(events: list[dict]) -> list[dict]:
    """Detect malicious WMI event subscriptions."""
    findings = []
    filters = {}
    consumers = {}

    for event in events:
        event_code = str(event.get("EventCode", event.get("EventID", "")))
        computer = event.get("Computer", event.get("host", ""))
        timestamp = event.get("UtcTime", event.get("_time", ""))
        user = event.get("User", event.get("user", ""))

        if event_code == "19":  # EventFilter
            name = event.get("Name", event.get("name", ""))
            query = event.get("Query", event.get("query", ""))
            filters[name] = {"query": query, "computer": computer, "timestamp": timestamp}

            for pattern, trigger_type in SUSPICIOUS_FILTER_PATTERNS:
                if re.search(pattern, query, re.IGNORECASE):
                    findings.append({
                        "timestamp": timestamp,
                        "computer": computer,
                        "user": user,
                        "event_type": "EventFilter",
                        "name": name,
                        "query": query,
                        "trigger_type": trigger_type,
                        "severity": "HIGH",
                        "technique": "T1546.003",
                    })
                    break

        elif event_code == "20":  # EventConsumer
            name = event.get("Name", event.get("name", ""))
            consumer_type = event.get("Type", event.get("Destination", ""))
            destination = event.get("Destination", event.get("destination", ""))
            consumers[name] = {"type": consumer_type, "destination": destination}

            severity = "CRITICAL" if any(dt in str(consumer_type) for dt in DANGEROUS_CONSUMER_TYPES) else "MEDIUM"

            indicators = []
            for pattern, indicator in SUSPICIOUS_CONSUMER_PATTERNS:
                if re.search(pattern, str(destination)):
                    indicators.append(indicator)
                    severity = "CRITICAL"

            findings.append({
                "timestamp": timestamp,
                "computer": computer,
                "user": user,
                "event_type": "EventConsumer",
                "name": name,
                "consumer_type": str(consumer_type),
                "destination": destination,
                "indicators": indicators,
                "severity": severity,
                "technique": "T1546.003",
            })

        elif event_code == "21":  # Binding
            consumer = event.get("Consumer", event.get("consumer", ""))
            filter_ref = event.get("Filter", event.get("filter", ""))
            findings.append({
                "timestamp": timestamp,
                "computer": computer,
                "user": user,
                "event_type": "FilterToConsumerBinding",
                "consumer": consumer,
                "filter": filter_ref,
                "severity": "HIGH",
                "technique": "T1546.003",
            })

        elif event_code == "1":  # Process creation
            parent = event.get("ParentImage", "")
            image = event.get("Image", "")
            cmdline = event.get("CommandLine", "")
            if "wmiprvse.exe" in parent.lower():
                image_name = image.split("\\")[-1].lower()
                if image_name in {"cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe"}:
                    findings.append({
                        "timestamp": timestamp,
                        "computer": computer,
                        "user": user,
                        "event_type": "WmiPrvSe_Child_Process",
                        "child_process": image,
                        "command_line": cmdline,
                        "severity": "HIGH",
                        "technique": "T1546.003",
                    })

    return sorted(findings, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}.get(x["severity"], 3))


def run_hunt(input_path: str, output_dir: str) -> None:
    """Execute WMI subscription persistence hunt."""
    print(f"[*] WMI Subscription Persistence Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_events(input_path)
    print(f"[*] Loaded {len(events)} events")

    findings = detect_wmi_persistence(events)
    print(f"[!] WMI persistence detections: {len(findings)}")

    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)

    with open(output_path / "wmi_persistence_findings.json", "w", encoding="utf-8") as f:
        json.dump({
            "hunt_id": f"TH-WMI-{datetime.date.today().isoformat()}",
            "total_events": len(events),
            "findings_count": len(findings),
            "findings": findings,
        }, f, indent=2)
    print(f"[+] Results written to {output_dir}")


def main():
    parser = argparse.ArgumentParser(description="WMI Subscription Persistence Detection")
    parser.add_argument("--input", "-i", required=True)
    parser.add_argument("--output", "-o", default="./wmi_hunt_output")
    args = parser.parse_args()
    run_hunt(args.input, args.output)


if __name__ == "__main__":
    main()