detecting-wmi-persistence

name	detecting-wmi-persistence
description	Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation. Use when detecting wmi event subscription persistence by analyzing sysmon event ids.
domain	cybersecurity
tags	["threat-hunting","wmi","persistence","sysmon","t1546.003","mitre-attack","windows","dfir"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Detecting Wmi Persistence

Overview

Cybersecurity skill for detecting wmi persistence. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting wmi persistence"

• "When hunting for WMI event subscription persistence (MITRE ATT&CK T1546"

• "After detecting suspicious WMI activity in endpoint telemetry"

• "During incident response to identify attacker persistence mechanisms"

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)

• After detecting suspicious WMI activity in endpoint telemetry

• During incident response to identify attacker persistence mechanisms

• When Sysmon alerts trigger on Event IDs 19, 20, or 21

• During purple team exercises testing WMI-based persistence

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
• Windows Security Event Log forwarding configured
• SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
• PowerShell access for WMI enumeration on endpoints
• Sysinternals Autoruns for manual WMI subscription review

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}