Detect Windows Management Instrumentation Event Subscription in Splunk
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Attackers use WMI subscriptions to achieve fileless persistence that survives reboots, runs as SYSTEM, and is not visible in the run keys or scheduled tasks that analysts typically check. Three components are required: an EventFilter (what triggers), an EventConsumer (what runs), and a FilterToConsumerBinding (links them together).
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.003 Windows Management Instrumentation Event Subscription
- Canonical reference
- https://attack.mitre.org/techniques/T1546/003/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Microsoft-Windows-WMI-Activity/Operational")
| eval EventSource=sourcetype
| eval WmiActivity=case(
EventCode=19, "WMI Filter Activity",
EventCode=20, "WMI Consumer Activity",
EventCode=21, "WMI Consumer Binding",
EventCode=5857, "WMI Provider Load",
EventCode=5858, "WMI Query Error",
EventCode=5861, "WMI Permanent Subscription",
1=1, null()
)
| eval WmiCmdLine=case(
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=1,
if(match(CommandLine, "(ActiveScriptEventConsumer|CommandLineEventConsumer|__EventFilter|FilterToConsumerBinding|root.subscription|ROOT.subscription)"), "WMI_CMD", null()),
1=1, null()
)
| where isnotnull(WmiActivity) OR WmiCmdLine="WMI_CMD"
| eval DetectionType=coalesce(WmiActivity, WmiCmdLine)
| table _time, host, User, EventCode, DetectionType, CommandLine, Message
| sort - _timeDetects WMI persistent event subscriptions using two data sources: Sysmon WMI events (Event ID 19=FilterActivity, 20=ConsumerActivity, 21=ConsumerBinding) which directly record subscription creation, and WMI Activity Operational log (Event ID 5861 = permanent subscription registered). Also detects WMI subscription creation via process command line analysis. Event IDs 19-21 are the highest-fidelity signals as Sysmon logs them natively.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Endpoint security products using WMI subscriptions for monitoring
- SCCM/ConfigMgr client WMI subscriptions
- Enterprise monitoring solutions
- Legitimate software using WMI for update triggers or license management
Other platforms for T1546.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WMI Subscription via PowerShell (CommandLineEventConsumer)
Expected signal: Sysmon Event ID 19: WmiEventFilter Activity (FilterName=ArgusTestFilter). Sysmon Event ID 20: WmiEventConsumer Activity (ConsumerName=ArgusTestConsumer, Type=CommandLineEventConsumer). Sysmon Event ID 21: WmiEventConsumerToFilter Binding. WMI-Activity/Operational Event ID 5861: Permanent subscription created.
- Test 2WMI Subscription via WMIC (ActiveScriptEventConsumer)
Expected signal: Sysmon Event IDs 19, 20, 21 for each WMI subscription component. The ActiveScriptEventConsumer type in Event ID 20 is higher risk than CommandLineEventConsumer. Process creation for wmic.exe with /NAMESPACE:\\root\subscription arguments.
- Test 3WMI Subscription via MOF File Compilation
Expected signal: Sysmon Event ID 1: Process creation for mofcomp.exe with the .mof file path as argument. Sysmon Event IDs 19, 20, 21 after mofcomp compiles the subscription. File creation event (Sysmon 11) for the .mof file in Temp. WMI repository modification events.
References (6)
- https://attack.mitre.org/techniques/T1546/003/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
- https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
- https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
- https://github.com/davidpany/WMI_Forensics
- https://github.com/mandiant/flare-wmi
Unlock Pro Content
Get the full detection package for T1546.003 including response playbook, investigation guide, and atomic red team tests.