medium
advisory
WMI Persistence - Security
Detection of suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 08:45 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This detection identifies suspicious WMI event filter and command line event consumer activity. The rule monitors the Windows Security log for Event ID 4662, specifically looking for access to WMI namespaces containing the term "subscription."
Detection coverage 1
Detect WMI Event Subscription Access
mediumDetects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
sigma
tactics: persistence, privilege-escalation
techniques: T1546.003
sources: windows, security
Detection queries are available on the platform. Get full rules →