detecting-wmi-persistence

name	detecting-wmi-persistence
description	Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","wmi","persistence","sysmon","t1546.003","mitre-attack","windows","dfir"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Detecting WMI Persistence

When to Use

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
• After detecting suspicious WMI activity in endpoint telemetry
• During incident response to identify attacker persistence mechanisms
• When Sysmon alerts trigger on Event IDs 19, 20, or 21
• During purple team exercises testing WMI-based persistence

Detection Gaps & Validation

• Sysmon 19/20/21 fire only on local root\subscription: subscriptions in a different namespace, or __EventConsumer objects written remotely before Sysmon was deployed, generate no 19/20/21 — sweep WMI directly (Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding) to catch pre-existing ones.
• MOF-based and remote creation: mofcomp.exe compiling a malicious .mof, or remote wmic /node: subscription creation, may surface only as EID 1 (mofcomp.exe/wmic.exe) — confirm command-line auditing is on.
• Timer evasion: __IntervalTimerInstruction/__AbsoluteTimerInstruction consumers fire on a clock rather than a process-start __InstanceModificationEvent WQL, sidestepping rules that only look for Win32_ProcessStartTrace.
• Consumer types: beyond CommandLineEventConsumer, watch ActiveScriptEventConsumer (VBScript/JScript) and LogFileEventConsumer.
• Validate: run Atomic Red Team T1546.003 (PowerShell or mofcomp subscription) and confirm Sysmon EID 19/20/21 land in the SIEM.
• Tune FPs: SCCM/ConfigMgr, SCOM, and some AV products create legitimate bindings (e.g., SCM Event Log Consumer) — allowlist those exact filter/consumer names, not the event type.

Prerequisites

• Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
• Windows Security Event Log forwarding configured
• SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
• PowerShell access for WMI enumeration on endpoints
• Sysinternals Autoruns for manual WMI subscription review

Workflow

1. Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).