PowerShell WMI Persistence via Event Subscription

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•23

This rule detects PowerShell script block logging events that indicate an attempt to establish persistence using Windows Management Instrumentation (WMI) event subscriptions. Specifically, it looks for the creation of WMI event filters (`__EventFilter`) and command-line event consumers (`CommandLineEventConsumer`) within the `root/subscription` namespace, which are common components of WMI persistence techniques.