name: detecting-wmi-persistence description: Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses. domain: cybersecurity subdomain: threat-hunting tags:

• threat-hunting
• wmi
• persistence
• sysmon
• t1546.003
• mitre-attack
• windows
• dfir

version: '1.0' author: mahipal license: Apache-2.0 d3fend_techniques:

• Application Protocol Command Analysis
• Network Isolation
• Network Traffic Analysis
• Client-server Payload Profiling
• Platform Monitoring

nist_csf:

• DE.CM-01
• DE.AE-02
• DE.AE-07
• ID.RA-05

mitre_attack:

• T1546.003
• T1047
• T1059.001

Detecting WMI Persistence

When to Use

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
• After detecting suspicious WMI activity in endpoint telemetry
• During incident response to identify attacker persistence mechanisms
• When Sysmon alerts trigger on Event IDs 19, 20, or 21
• During purple team exercises testing WMI-based persistence

Prerequisites

• Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
• Windows Security Event Log forwarding configured
• SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
• PowerShell access for WMI enumeration on endpoints
• Sysinternals Autoruns for manual WMI subscription review

Workflow

1. Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
2. Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
3. Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
4. Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
5. Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
6. Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
7. Document and Remediate: Remove malicious subscriptions and update detection rules.

Key Concepts

Tools & Systems

Output Format

Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]