WMI Persistence via Event Subscription

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•25

Detects suspicious WMI event filter and command line event consumer creation or modification based on WMI and Security Logs. This rule specifically looks for EventID 5861 (WMI filter to consumer binding) and EventID 5859 (WMI filter registration) in conjunction with common consumer keywords like 'ActiveScriptEventConsumer' and 'CommandLineEventConsumer'. It excludes legitimate SCM Event Provider activity.