Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

FreeUnreviewedSigmamediumv1

windows-wmi-event-subscription-creation-sysmon-event-19-20-21-0f06a3a5

title: Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)
id: 032b2076-5639-43f4-a29d-deb1c6769dfc
status: test
description: This rule identifies the creation and activity of WMI event subscriptions by matching Sysmon event IDs 19, 20, and 21. Attackers can use WMI subscriptions to establish persistence by triggering actions when specific system or application conditions occur. Telemetry relies on Windows Sysmon WMI event logs that report subscription filter and consumer behavior.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml
author: Tom Ueltschi (@c_APT_ure), Huntrule Team
date: 2019-01-12
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  category: wmi_event
detection:
  selection:
    EventID:
      - 19
      - 20
      - 21
  condition: selection
falsepositives:
  - Exclude legitimate (vetted) use of WMI event subscription in your network
level: medium
license: DRL-1.1
related:
  - id: 0f06a3a5-6a09-413f-8743-e6cf35561297
    type: derived

What it detects

This rule identifies the creation and activity of WMI event subscriptions by matching Sysmon event IDs 19, 20, and 21. Attackers can use WMI subscriptions to establish persistence by triggering actions when specific system or application conditions occur. Telemetry relies on Windows Sysmon WMI event logs that report subscription filter and consumer behavior.

Known false positives

Exclude legitimate (vetted) use of WMI event subscription in your network

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.