I'm not entirely sure whether this is the right forum for this question or not, so please point me elsewhere if it's not.
We're trying to set up some WMI filters to watch for malicious use of WMI to launch processes on remote machines. If we create an event filter in the root\subscription namespace using this query:
SELECT * FROM MSFT_WmiProvider_ExecQueryAsyncEvent_Pre WHERE ObjectPath="Win32_Process" AND MethodName="Create"
Together with an appropriate NtEventLogEventConsumer and FilterToConsumerBinding, we can use the InputParameters.CommandLine property of the extrinsic event to extract the called command line, as long as WMI (the Invoke-WMIMethod powershell cmdlet specifically)
is used to call Win32_Process.Create(). However, we see some strange behavior if we use CIM to invoke Win32_Process.Create() (Invoke-CIMMethod).
In that case, the InputParameters object returned by the MSFT_WmiProvider_ExecQueryAsyncEvent_Pre event is either entirely populated with null values (if the Invoke-CIMMethod cmdlet is the first one run in the session) or populated with the values from the
previous event (if the Invoke-WMIMethod cmdlet was called earlier).
Does anyone on here have a potential explanation for this inconsistent behavior? Or can recommend an alternate method for capturing the process creation event that will yield the called command line in all cases?