Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

WMI Permanent Event Subscription - Sysmon

The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.

ATT&CK coverage

Outside the enterprise matrix

T1546.003Windows Management Instrumentation Event Subscription 17 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_21

What the source says

What fires this without an attack behind it

Although unlikely, administrators may use event subscriptions for legitimate purposes.

References

Tagged by the source as

Suspicious WMI UseEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.