detecting-wmi-persistence

name	detecting-wmi-persistence
description	Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","wmi","persistence","sysmon","t1546.003","mitre-attack","windows","dfir"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]
mitre_attack	["T1546.003","T1047","T1059.001"]

Detecting WMI Persistence

When to Use

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
• After detecting suspicious WMI activity in endpoint telemetry
• During incident response to identify attacker persistence mechanisms
• When Sysmon alerts trigger on Event IDs 19, 20, or 21
• During purple team exercises testing WMI-based persistence

Prerequisites

• Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
• Windows Security Event Log forwarding configured
• SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
• PowerShell access for WMI enumeration on endpoints
• Sysinternals Autoruns for manual WMI subscription review

Workflow

1. Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
2. Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
3. Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
4. Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
5. Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
6. Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
7. Document and Remediate: Remove malicious subscriptions and update detection rules.

Key Concepts

Concept	Description
Sysmon Event 19	WmiEventFilter creation detected
Sysmon Event 20	WmiEventConsumer creation detected
Sysmon Event 21	WmiEventConsumerToFilter binding detected
T1546.003	Event Triggered Execution: WMI Event Subscription
CommandLineEventConsumer	Executes system commands when filter triggers
ActiveScriptEventConsumer	Runs VBScript/JScript when filter triggers

Tools & Systems

Tool	Purpose