Detect Windows Management Instrumentation Event Subscription in Microsoft Sentinel
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Attackers use WMI subscriptions to achieve fileless persistence that survives reboots, runs as SYSTEM, and is not visible in the run keys or scheduled tasks that analysts typically check. Three components are required: an EventFilter (what triggers), an EventConsumer (what runs), and a FilterToConsumerBinding (links them together).
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.003 Windows Management Instrumentation Event Subscription
- Canonical reference
- https://attack.mitre.org/techniques/T1546/003/
KQL Detection Query
let WmiConsumerCreation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
"ActiveScriptEventConsumer", "CommandLineEventConsumer",
"__EventFilter", "__EventConsumer", "__FilterToConsumerBinding",
"ROOT\\subscription", "root/subscription"
)
| extend WmiComponent = case(
ProcessCommandLine has "__EventFilter", "EventFilter",
ProcessCommandLine has "__EventConsumer" or ProcessCommandLine has "CommandLineEventConsumer" or ProcessCommandLine has "ActiveScriptEventConsumer", "EventConsumer",
ProcessCommandLine has "__FilterToConsumerBinding", "Binding",
"Unknown"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, WmiComponent,
InitiatingProcessFileName, InitiatingProcessCommandLine;
let WmiPersistenceIndicators = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("wbem", "repository")
| where FileName has_any ("OBJECTS.DATA", "index.btr", "mapping");
union WmiConsumerCreation, (WmiPersistenceIndicators | extend WmiComponent="RepositoryChange")
| sort by Timestamp descDetects WMI event subscription creation by monitoring process command lines for WMI subscription class names (ActiveScriptEventConsumer, CommandLineEventConsumer, __EventFilter, __FilterToConsumerBinding) and ROOT\subscription namespace references. Also monitors for modifications to the WMI repository files in the wbem directory. WMI subscriptions created via PowerShell, WMIC, or direct MOF compilation are all captured.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint security products (Microsoft Defender for Endpoint, CrowdStrike, Carbon Black) that use WMI subscriptions for their own monitoring and persistence
- SCCM/ConfigMgr client that uses WMI subscriptions for hardware inventory and software distribution tracking
- Enterprise monitoring solutions (SolarWinds, SCOM, Nagios agents) that leverage WMI event subscriptions for system monitoring
- Legitimate software that uses WMI subscriptions for update triggers or license management (some AV products, backup agents)
Other platforms for T1546.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WMI Subscription via PowerShell (CommandLineEventConsumer)
Expected signal: Sysmon Event ID 19: WmiEventFilter Activity (FilterName=ArgusTestFilter). Sysmon Event ID 20: WmiEventConsumer Activity (ConsumerName=ArgusTestConsumer, Type=CommandLineEventConsumer). Sysmon Event ID 21: WmiEventConsumerToFilter Binding. WMI-Activity/Operational Event ID 5861: Permanent subscription created.
- Test 2WMI Subscription via WMIC (ActiveScriptEventConsumer)
Expected signal: Sysmon Event IDs 19, 20, 21 for each WMI subscription component. The ActiveScriptEventConsumer type in Event ID 20 is higher risk than CommandLineEventConsumer. Process creation for wmic.exe with /NAMESPACE:\\root\subscription arguments.
- Test 3WMI Subscription via MOF File Compilation
Expected signal: Sysmon Event ID 1: Process creation for mofcomp.exe with the .mof file path as argument. Sysmon Event IDs 19, 20, 21 after mofcomp compiles the subscription. File creation event (Sysmon 11) for the .mof file in Temp. WMI repository modification events.
References (6)
- https://attack.mitre.org/techniques/T1546/003/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
- https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
- https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
- https://github.com/davidpany/WMI_Forensics
- https://github.com/mandiant/flare-wmi
Unlock Pro Content
Get the full detection package for T1546.003 including response playbook, investigation guide, and atomic red team tests.