huntrule

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

FreeReviewedSigma · Medium · v1
Product
windows
Category
wmi_event
Author
Tom Ueltschi (@c_APT_ure) (SigmaHQ), DRL 1.1
Published
2019-01-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies the creation and activity of WMI event subscriptions by matching Sysmon event IDs 19, 20, and 21. Attackers can use WMI subscriptions to establish persistence by triggering actions when specific system or application conditions occur. Telemetry relies on Windows Sysmon WMI event logs that report subscription filter and consumer behavior.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange
Malicious WMI Registration - PowerShell (via powershell)
Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)
Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings
PowerShell WMI Event Subscription Persistence via New-CimInstance
Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt
Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers
WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)
Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution
Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe
Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)
Pivot detection · T1546.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.