hunting-for-persistence-via-wmi-subscriptions

name	hunting-for-persistence-via-wmi-subscriptions
description	Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events. Use when hunting for adversary persistence through windows management instrumentation event subscriptions.
domain	cybersecurity
tags	["threat-hunting","wmi-persistence","mitre-t1546-003","event-subscription","windows","endpoint-detection"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Persistence Via Wmi Subscriptions

Overview

Cybersecurity skill for hunting for persistence via wmi subscriptions. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting for persistence via wmi subscriptions"

• "When proactively searching for fileless persistence mechanisms in Windows enviro"

• "After threat intelligence reports indicate WMI-based persistence by APT groups ("

• "When investigating systems where malware persists across reboots despite cleanup"

• When proactively searching for fileless persistence mechanisms in Windows environments

• After threat intelligence reports indicate WMI-based persistence by APT groups (APT29, APT32, FIN8)

• When investigating systems where malware persists across reboots despite cleanup attempts

• During incident response when standard persistence locations (Run keys, scheduled tasks) are clean

• When WmiPrvSe.exe is observed spawning unexpected child processes

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon Event ID 19, 20, 21 (WMI Event Filter/Consumer/Binding) enabled
• Windows Event ID 5861 (WMI activity logging) from Microsoft-Windows-WMI-Activity
• PowerShell logging enabled (Script Block Logging, Module Logging)
• WMI repository access for enumeration
• SIEM platform for event correlation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}