Cross-source coverage
T1546.003 / ATT&CK
Event Triggered Execution: Windows Management Instrumentation Event Subscription
22 rules across 6 sources.
From MITRE ATT&CK 19.2
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.
Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may also compile WMI scripts – using mofcomp.exe –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.
WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
- Tactics
- Privilege Escalation · Persistence
- Platforms
- Windows
- Telemetry
-
WinEventLog:WMIWinEventLog:Sysmon
How MITRE says to detect it DET0086
Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation
Windows Analytic 0236
Monitor for creation of WMI EventFilter, EventConsumer, and FilterToConsumerBinding objects through WMI or MOF file execution. Detect command-line execution of `mofcomp.exe`, usage of `Register-WmiEvent` via PowerShell, and anomalous child processes of `WmiPrvSE.exe` that indicate triggered execution. Look for lateral anomalies in process lineage and WMI logging channels.
WinEventLog:WMIEventCode=5857, 5858, 5860, 5861WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7
SigmaHQ/sigma
12 rules| Detection | Severity | Format |
|---|---|---|
| WMI Backdoor Exchange Transport Agent | Critical | Sigma |
| NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE | High | Sigma |
| Suspicious Encoded Scripts in a WMI Consumer | High | Sigma |
| WMI Persistence - Command Line Event Consumer | High | Sigma |
| WMI Persistence - Script Event Consumer File Write | High | Sigma |
| Potential Remote WMI ActiveScriptEventConsumers Activity | Medium | Sigma |
| Powershell WMI Persistence | Medium | Sigma |
| WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load | Medium | Sigma |
| WMI Event Subscription | Medium | Sigma |
| WMI Persistence | Medium | Sigma |
+ 2 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious WMI Event Subscription Created | Medium | Elastic TOML |
| Mofcomp Activity | Low | Elastic TOML |
| Persistence via WMI Event Subscription | Low | Elastic TOML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Detect WMI Event Subscription Persistence | Undefined | SPL |
| Windows MOF Event Triggered Execution via WMI | Undefined | SPL |
| WMI Permanent Event Subscription - Sysmon | Undefined | SPL |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| WmiConsumerEvent created, possible persistence tactic using command-executing binaries | Critical | Wazuh XML |
| WmiConsumerEvent created, possible persistence tactic | High | Wazuh XML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| detect-impacket-wmipersist | Undefined | KQL |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious WMI Event Consumer Subscription | Undefined | Elastic TOML |