Detection of WMI Event Subscription Persistence

Windows Management Instrumentation (WMI) provides a powerful interface for system administration, but it is frequently abused by threat actors to achieve persistence and execute arbitrary code. By configuring WMI event subscriptions, attackers can trigger the execution of malicious scripts or binaries in response to specific system events, such as system startup, time intervals, or process termination. These subscriptions consist of three primary components: an Event Filter to define the trigger condition, an Event Consumer to specify the action to take, and a Filter-To-Consumer Binding to link the two. Monitoring for the creation of these components is a critical detection capability for identifying adversary activity that attempts to maintain long-term access to a compromised Windows host.

Impact

Successful abuse of WMI event subscriptions enables attackers to maintain persistent access that survives system reboots and is often invisible to standard user-mode autostart monitoring tools. This technique facilitates privilege escalation, lateral movement, and the execution of further stages of an attack chain within a target environment.

Recommendation

• Enable Sysmon logging for WMI activity to provide the necessary telemetry for detection.
• Deploy the provided Sigma rule to your SIEM to monitor for the registration of new WMI event filters, consumers, and bindings.
• Establish a baseline of legitimate WMI event subscriptions in the environment to tune out administrative activity and reduce false positives.