WMI event subscription
A WMI permanent event subscription was established — a consumer registered (Sysmon 20, which carries the command/script it will run) or a…
What it detects
A WMI permanent event subscription was established — a consumer registered (Sysmon 20, which carries the command/script it will run) or a consumer-to-filter binding created (Sysmon 21, which activates the subscription). WMI event subscriptions are a stealthy, fileless persistence mechanism: a filter (a trigger condition) plus a consumer (an action, typically a CommandLine or ActiveScript payload) bound together run attacker code on an event (logon, a time interval, process start) with no autostart entry on disk. Permanent subscriptions are rare in normal operations, so their creation is a strong persistence lead. A filter alone (Sysmon 19) is intentionally NOT flagged — it isn't persistence until a consumer/binding exists.
MITRE ATT&CK mapping
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription· Persistence
False positives and triage
A few management and monitoring products (SCCM/MECM, some backup/EDR agents) register WMI subscriptions legitimately. The strong signal is a CommandLineEventConsumer or ActiveScriptEventConsumer whose payload launches a shell / encoded command / script, or a subscription created by an interactive or non-admin account. Confirm the consumer's Destination payload and the creating account; allow-list a known management tool if needed.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/wmi_event_subscription.yaml, licensed under the Apache License 2.0.
id: windows.persistence.wmi_event_subscription
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1546.003]
description: |
A WMI permanent event subscription was established — a consumer registered (Sysmon 20,
which carries the command/script it will run) or a consumer-to-filter binding created
(Sysmon 21, which activates the subscription). WMI event subscriptions are a stealthy,
fileless persistence mechanism: a filter (a trigger condition) plus a consumer (an action,
typically a CommandLine or ActiveScript payload) bound together run attacker code on an
event (logon, a time interval, process start) with no autostart entry on disk. Permanent
subscriptions are rare in normal operations, so their creation is a strong persistence
lead. A filter alone (Sysmon 19) is intentionally NOT flagged — it isn't persistence until
a consumer/binding exists.
match:
event_action_any:
- wmi_consumer_registered
- wmi_subscription_bound
false_positive_guidance: |
A few management and monitoring products (SCCM/MECM, some backup/EDR agents) register WMI
subscriptions legitimately. The strong signal is a CommandLineEventConsumer or
ActiveScriptEventConsumer whose payload launches a shell / encoded command / script, or a
subscription created by an interactive or non-admin account. Confirm the consumer's
Destination payload and the creating account; allow-list a known management tool if needed.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.