Every published rule

Windows Image Load: WMI DLLs Loaded by Uncommon Process

Alert on loading of common WMI DLLs by processes outside typical system/.NET paths.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Process Creation Attempt Using wmic.exe process call create

Alerts on Windows process creation attempts invoking wmic.exe with “process call create”, a common pattern for WMI-based execution.

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

Windows WMI Script Event Consumer Execution via scrcons.exe

Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.

Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe

Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.

Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)

Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.

Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.