Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.003Windows Management Instrumentation Event Subscription
Priv Esc
- T1546.003Windows Management Instrumentation Event Subscription
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies the creation and activity of WMI event subscriptions by matching Sysmon event IDs 19, 20, and 21. Attackers can use WMI subscriptions to establish persistence by triggering actions when specific system or application conditions occur. Telemetry relies on Windows Sysmon WMI event logs that report subscription filter and consumer behavior.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange

Malicious WMI Registration - PowerShell (via powershell)

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

PowerShell WMI Event Subscription Persistence via New-CimInstance

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Pivot detection · T1546.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmi-event-subscription-creation-sysmon-event-19-20-21-0f06a3a5

title: Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)
id: 032b2076-5639-43f4-a29d-deb1c6769dfc
status: test
description: This rule identifies the creation and activity of WMI event subscriptions by matching Sysmon event IDs 19, 20, and 21. Attackers can use WMI subscriptions to establish persistence by triggering actions when specific system or application conditions occur. Telemetry relies on Windows Sysmon WMI event logs that report subscription filter and consumer behavior.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml
author: Tom Ueltschi (@c_APT_ure), Huntrule Team
date: 2019-01-12
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  category: wmi_event
detection:
  selection:
    EventID:
      - 19
      - 20
      - 21
  condition: selection
falsepositives:
  - Exclude legitimate (vetted) use of WMI event subscription in your network
level: medium
license: DRL-1.1
related:
  - id: 0f06a3a5-6a09-413f-8743-e6cf35561297
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL