Detecting Wmi Persistence

Detecting WMI Persistence

When to Use

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
• After detecting suspicious WMI activity in endpoint telemetry
• During incident response to identify attacker persistence mechanisms
• When Sysmon alerts trigger on Event IDs 19, 20, or 21
• During purple team exercises testing WMI-based persistence

Detection Gaps & Validation

• Sysmon 19/20/21 fire only on local root\subscription: subscriptions in a different namespace, or __EventConsumer objects written remotely before Sysmon was deployed, generate no 19/20/21 — sweep WMI directly (Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding) to catch pre-existing ones.
• MOF-based and remote creation: mofcomp.exe compiling a malicious .mof, or remote wmic /node: subscription creation, may surface only as EID 1 (mofcomp.exe/wmic.exe) — confirm command-line auditing is on.
• Timer evasion: __IntervalTimerInstruction/__AbsoluteTimerInstruction consumers fire on a clock rather than a process-start __InstanceModificationEvent WQL, sidestepping rules that only look for Win32_ProcessStartTrace.
• Consumer types: beyond CommandLineEventConsumer, watch ActiveScriptEventConsumer (VBScript/JScript) and LogFileEventConsumer.
• Validate: run Atomic Red Team T1546.003 (PowerShell or mofcomp subscription) and confirm Sysmon EID 19/20/21 land in the SIEM.
• Tune FPs: SCCM/ConfigMgr, SCOM, and some AV products create legitimate bindings (e.g., SCM Event Log Consumer) — allowlist those exact filter/consumer names, not the event type.

Prerequisites

• Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
• Windows Security Event Log forwarding configured
• SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
• PowerShell access for WMI enumeration on endpoints
• Sysinternals Autoruns for manual WMI subscription review

Workflow

1. Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
2. Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
3. Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
4. Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
5. Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
6. Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
7. Document and Remediate: Remove malicious subscriptions and update detection rules.

Key Concepts

Tools & Systems

Output Format

Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]