Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community (SigmaHQ), DRL 1.1
Published: 2017-08-22
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.003Windows Management Instrumentation Event Subscription
Priv Esc
- T1546.003Windows Management Instrumentation Event Subscription
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies access events in the Windows Security log where an account interacts with the WMI namespace containing "subscription". This activity is commonly associated with setting up or modifying WMI event filters and their command-line event consumers, which attackers can use for persistence. The detection relies on Security log Event ID 4662 telemetry with ObjectType set to "WMI Namespace" and ObjectName containing "subscription".

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange

Malicious WMI Registration - PowerShell (via powershell)

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

PowerShell WMI Event Subscription Persistence via New-CimInstance

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Pivot detection · T1546.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmi-persistence-via-subscription-namespace-objecttype-security-event-466-f033f3f3

title: Windows WMI Persistence via Security Event 4662 on WMI subscription namespace
id: 5ec73ec3-7e8d-4f4c-8f42-e39543ee7f80
related:
  - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
    type: derived
  - id: f033f3f3-fd24-4995-97d8-a3bb17550a88
    type: derived
status: test
description: Identifies access events in the Windows Security log where an account interacts with the WMI namespace containing "subscription". This activity is commonly associated with setting up or modifying WMI event filters and their command-line event consumers, which attackers can use for persistence. The detection relies on Security log Event ID 4662 telemetry with ObjectType set to "WMI Namespace" and ObjectName containing "subscription".
references:
  - https://twitter.com/mattifestation/status/899646620148539397
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_wmi_persistence.yml
author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community, Huntrule Team
date: 2017-08-22
modified: 2022-11-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: WMI Namespace
    ObjectName|contains: subscription
  condition: selection
falsepositives:
  - Unknown (data set is too small; further testing needed)
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL