Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.

FreeReviewedSigma · Medium · v2

Product: windows
Service: wmi
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community (SigmaHQ), DRL 1.1
Published: 2017-08-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.003Windows Management Instrumentation Event Subscription
Priv Esc
- T1546.003Windows Management Instrumentation Event Subscription
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies potential WMI persistence by matching creation or binding activity for WMI event filters and event consumers. It flags Security/WMI events tied to EventID 5861 and consumer components such as ActiveScriptEventConsumer and CommandLineEventConsumer, as well as EventID 5859 for WMI filter registration. The behavior matters because WMI event subscriptions can execute attacker-controlled code when triggers occur, and the detection relies on Windows WMI-related auditing events plus Security telemetry.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange

Malicious WMI Registration - PowerShell (via powershell)

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

PowerShell WMI Event Subscription Persistence via New-CimInstance

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Pivot detection · T1546.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmi-persistence-via-event-filter-and-event-consumer-event-ids-5861-and-5-0b7889b4

title: Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration
id: d0128ba4-9b04-49d1-9afa-5feaeb8f57db
status: test
description: This rule identifies potential WMI persistence by matching creation or binding activity for WMI event filters and event consumers. It flags Security/WMI events tied to EventID 5861 and consumer components such as ActiveScriptEventConsumer and CommandLineEventConsumer, as well as EventID 5859 for WMI filter registration. The behavior matters because WMI event subscriptions can execute attacker-controlled code when triggers occur, and the detection relies on Windows WMI-related auditing events plus Security telemetry.
references:
  - https://twitter.com/mattifestation/status/899646620148539397
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/wmi/win_wmi_persistence.yml
author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community, Huntrule Team
date: 2017-08-22
modified: 2022-02-10
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  product: windows
  service: wmi
  definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher
detection:
  wmi_filter_to_consumer_binding:
    EventID: 5861
  consumer_keywords:
    - ActiveScriptEventConsumer
    - CommandLineEventConsumer
    - CommandLineTemplate
  wmi_filter_registration:
    EventID: 5859
  filter_scmevent:
    Provider: SCM Event Provider
    Query: select * from MSFT_SCMEventLogEvent
    User: S-1-5-32-544
    PossibleCause: Permanent
  condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent
falsepositives:
  - Unknown (data set is too small; further testing needed)
level: medium
license: DRL-1.1
related:
  - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL