Webapp Detecting Wmi Persistence

---
name: webapp-detecting-wmi-persistence
description: Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.
domain: webapp
category: threat-intelligence
hide: true
license: Apache-2.0
metadata:
  manifest_entry: src/corpus/webapp-detecting-wmi-persistence/SKILL.md
---
# Detecting WMI Persistence

## When to Use

- When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
- After detecting suspicious WMI activity in endpoint telemetry
- During incident response to identify attacker persistence mechanisms
- When Sysmon alerts trigger on Event IDs 19, 20, or 21
- During purple team exercises testing WMI-based persistence

## Detection Gaps & Validation

- **Sysmon 19/20/21 fire only on local `root\subscription`:** subscriptions in a different namespace, or `__EventConsumer` objects written remotely before Sysmon was deployed, generate no 19/20/21 — sweep WMI directly (`Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding`) to catch pre-existing ones.
- **MOF-based and remote creation:** `mofcomp.exe` compiling a malicious `.mof`, or remote `wmic /node:` subscription creation, may surface only as EID 1 (`mofcomp.exe`/`wmic.exe`) — confirm command-line auditing is on.
- **Timer evasion:** `__IntervalTimerInstruction`/`__AbsoluteTimerInstruction` consumers fire on a clock rather than a process-start `__InstanceModificationEvent` WQL, sidestepping rules that only look for `Win32_ProcessStartTrace`.
- **Consumer types:** beyond CommandLineEventConsumer, watch `ActiveScriptEventConsumer` (VBScript/JScript) and `LogFileEventConsumer`.
- **Validate:** run Atomic Red Team **T1546.003** (PowerShell or `mofcomp` subscription) and confirm Sysmon EID 19/20/21 land in the SIEM.
- **Tune FPs:** SCCM/ConfigMgr, SCOM, and some AV products create legitimate bindings (e.g., `SCM Event Log Consumer`) — allowlist those exact filter/consumer names, not the event type.

## Prerequisites

- Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
- Windows Security Event Log forwarding configured
- SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
- PowerShell access for WMI enumeration on endpoints
- Sysinternals Autoruns for manual WMI subscription review

## Workflow

1. **Collect Telemetry**: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
2. **Identify Suspicious Consumers**: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
3. **Analyze Event Filters**: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
4. **Correlate Bindings**: Match FilterToConsumerBindings linking suspicious filters to consumers.
5. **Check Persistence Locations**: Query WMI namespaces root\subscription and root\default for active subscriptions.
6. **Validate Findings**: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
7. **Document and Remediate**: Remove malicious subscriptions and update detection rules.

## Key Concepts

| Concept | Description |
|---------|-------------|
| Sysmon Event 19 | WmiEventFilter creation detected |
| Sysmon Event 20 | WmiEventConsumer creation detected |
| Sysmon Event 21 | WmiEventConsumerToFilter binding detected |
| T1546.003 | Event Triggered Execution: WMI Event Subscription |
| CommandLineEventConsumer | Executes system commands when filter triggers |
| ActiveScriptEventConsumer | Runs VBScript/JScript when filter triggers |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| Sysmon | Windows event monitoring for WMI activity |
| WMI Explorer | GUI tool for browsing WMI namespaces |
| Autoruns | Sysinternals tool listing persistence mechanisms |
| PowerShell Get-WMIObject | Enumerate WMI event subscriptions |
| Splunk | SIEM analysis of Sysmon WMI events |
| Velociraptor | Endpoint WMI artifact collection |

## Output Format

```
Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]
```