skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-wmi-persistence

Detect WMI event subscription persistence using Sysmon Event IDs 19, 20, and 21.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#windows#sysmon#DFIR#wmi persistence#t1546.003
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-wmi-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-wmi-persistence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-wmi-persistence
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-wmi-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers establish stealthy persistence on Windows systems through WMI event subscriptions (MITRE ATT&CK T1546.003), which are difficult to spot without a structured hunting methodology. This Skill guides analysts through detecting malicious EventFilters, EventConsumers, and FilterToConsumerBindings using Sysmon telemetry.

Core Features & Use Cases

  • Sysmon-Based Detection: Analyzes Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), and 21 (WmiEventConsumerToFilter) to surface subscription creation.
  • Evasion-Aware Hunting: Covers detection gaps such as MOF-based creation, remote subscription deployment, timer-based triggers, and ActiveScriptEventConsumer abuse.
  • Use Case: During incident response, an analyst notices suspicious WMI activity on an endpoint and uses this workflow to enumerate root\subscription bindings, identify a malicious CommandLineEventConsumer, validate it against known-good SCCM subscriptions, and document the finding for remediation.

Quick Start

Hunt for WMI event subscription persistence on this host by analyzing Sysmon Event IDs 19, 20, and 21 and listing any suspicious filter-to-consumer bindings.

Frequently Asked Questions about detecting-wmi-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect WMI event subscription persistence on Windows?▼

Detect WMI persistence by parsing Sysmon Event IDs 19, 20, and 21, which log EventFilter, EventConsumer, and FilterToConsumerBinding creation. Flag CommandLineEventConsumer and ActiveScriptEventConsumer types, then enumerate root\subscription with PowerShell Get-WmiObject to confirm active bindings.

What Sysmon event IDs indicate WMI persistence activity?▼

Sysmon Event ID 19 logs WmiEventFilter creation, Event ID 20 logs WmiEventConsumer creation, and Event ID 21 logs FilterToConsumerBinding. Together these three events reveal the full WMI subscription chain used for persistence under MITRE ATT&CK T1546.003.

Can WMI subscriptions be created without triggering Sysmon events?▼

Yes. Subscriptions created remotely, compiled via mofcomp.exe, or written before Sysmon deployment may not generate Events 19-21. Sweep WMI directly with Get-WmiObject against root\subscription and monitor process creation events for mofcomp.exe and wmic.exe.

How do I reduce false positives when hunting WMI persistence?▼

Legitimate software like SCCM, ConfigMgr, SCOM, and some antivirus products create WMI subscriptions such as the SCM Event Log Consumer. Allowlist those exact filter and consumer names rather than excluding the event type entirely, and validate detections with Atomic Red Team T1546.003 tests.

What tools are needed to hunt for WMI persistence?▼

You need Sysmon v6.1+ with WMI logging enabled, a SIEM such as Splunk, Elastic, or Sentinel ingesting the events, and PowerShell for WMI enumeration. Sysinternals Autoruns, WMI Explorer, and Velociraptor support manual review and endpoint artifact collection.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
kubesharkkubeshark
12.1k

security-audit

Audits Kubernetes cluster network traffic for threats and indicators of compromise using Kubeshark MCP.

Official
Advanced
dreadnodedreadnode
11

persistence-hunt

Enumerate Windows memory persistence mechanisms and map them to MITRE ATT&CK technique IDs.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced