skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-persistence-via-wmi-subscriptions

Detects adversary persistence through WMI event subscriptions using Sysmon and Windows event telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#windows#siem#sysmon#wmi persistence#t1546.003
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-persistence-via-wmi-subscriptions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-persistence-via-wmi-subscriptions
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-persistence-via-wmi-subscriptions
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-persistence-via-wmi-subscriptions

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers achieve fileless persistence on Windows by creating WMI event subscriptions that survive reboots and evade standard persistence checks like Run keys and scheduled tasks. This Skill guides analysts through hunting for these hidden subscriptions before they trigger malicious payloads.

Core Features & Use Cases

  • Subscription Enumeration: Query __EventFilter, __EventConsumer, and __FilterToConsumerBinding classes to inventory permanent WMI subscriptions on endpoints.
  • Detection Queries: Ready-to-use Splunk, KQL, PowerShell, and Sigma detections for Sysmon Event IDs 19/20/21 and Windows Event 5861.
  • Evasion-Aware Guidance: Covers detection gaps such as non-standard consumers, alternate namespaces, and benign-looking timer triggers used by APT29, FIN8, and Turla.
  • Use Case: During incident response, a host keeps getting reinfected despite cleanup. Use this Skill to enumerate WMI subscriptions, find a malicious ActiveScriptEventConsumer running VBScript at startup, and remove it.

Quick Start

Hunt for WMI event subscription persistence on my Windows endpoints and list any suspicious filters, consumers, and bindings.

Frequently Asked Questions about hunting-for-persistence-via-wmi-subscriptions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect WMI event subscription persistence on Windows?▼

Enable Sysmon Event IDs 19, 20, and 21 to capture WMI filter, consumer, and binding creation, plus Windows Event 5861 from the WMI-Activity log. Then enumerate existing subscriptions with Get-WmiObject against the root\subscription namespace and flag ActiveScriptEventConsumer or CommandLineEventConsumer entries.

What WMI consumer types are used for malicious persistence?▼

ActiveScriptEventConsumer and CommandLineEventConsumer are the dangerous types. ActiveScriptEventConsumer runs embedded VBScript or JScript inline, while CommandLineEventConsumer executes arbitrary commands when the linked event filter triggers.

Why does my WMI persistence hunt miss some subscriptions?▼

Subscriptions can hide in non-standard namespaces like root\default instead of root\subscription, or use less-monitored consumers like LogFileEventConsumer. Event 5861 also does not log all filter activity, so relying on it alone produces false negatives without Sysmon coverage.

How do I validate that WMI detection rules actually fire?▼

Install a test __EventFilter and CommandLineEventConsumer binding using PowerShell or mofcomp.exe, following Atomic Red Team test T1546.003. Confirm that Sysmon Events 19/20/21 and Windows Event 5861 are generated and that the WmiPrvSe.exe child process is detected.

What legitimate software creates WMI event subscriptions?▼

SCCM, antivirus products, and monitoring agents commonly create legitimate permanent subscriptions. Baseline existing bindings per host and alert only on new or unsigned subscriptions to reduce false positives.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
wgpsecwgpsec
1.7k

emergency-response

Investigate compromised Linux and Windows hosts through account, process, persistence, and log analysis.

Official
Advanced
dandyedandye
120

hunt-lateral-movement

Detect lateral movement indicators via PsExec and WMI across enterprise endpoints.

Community
Advanced
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced