PowerShell WMI Event Subscription Persistence

Adversaries frequently abuse Windows Management Instrumentation (WMI) to maintain persistence on compromised Windows hosts. By creating WMI event subscriptions, attackers can ensure their malicious code executes automatically when specific system conditions are met, such as system uptime, a specific time, or a user logon. This technique involves defining an Event Filter to monitor for a trigger and an Event Consumer to execute the payload. When using PowerShell to automate this process, adversaries often leverage the 'New-CimInstance' cmdlet to interact with the 'root/subscription' namespace. Because this mechanism relies on built-in administrative tools and runs with system privileges, it provides a stealthy way for attackers to maintain long-term access and potentially escalate privileges without needing to drop custom services or modify common startup locations.

Attack Chain

1. Attacker gains initial code execution on a target Windows system.
2. Attacker prepares a malicious payload (e.g., a reverse shell or script).
3. Attacker uses PowerShell to define a WMI '__EventFilter' to monitor for a specific system trigger.
4. Attacker uses PowerShell to define a 'CommandLineEventConsumer' which specifies the command to execute.
5. Attacker links the filter and consumer using a '__FilterToConsumerBinding' instance.
6. The system reaches the trigger condition defined in the Event Filter.
7. The WMI service executes the Command Line Event Consumer with SYSTEM privileges.
8. Malicious code executes, achieving persistence or privilege escalation.

Impact

Successful exploitation allows for long-term, stealthy persistence on a compromised host. Since WMI tasks often run as the SYSTEM account, this technique effectively facilitates privilege escalation if the initial access was obtained in a lower-privileged context. This enables attackers to survive reboots and evade simple detection methods that focus on common registry-based startup persistence.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across the environment to capture command-line activity.
• Deploy the provided Sigma rule to monitor for the creation of CIM instances related to WMI subscriptions.
• Audit existing WMI event consumers and filters for suspicious command-line arguments.
• Restrict access to administrative WMI namespaces for non-privileged accounts.