WMI Event Subscription Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•34

Detects the creation of WMI event subscriptions, which can be used as a persistence mechanism by adversaries. This rule specifically looks for Sysmon Event IDs 19 (WmiEventFilter activity), 20 (WmiEventConsumer activity), and 21 (WmiEventConsumerToFilter activity), indicating the creation or modification of WMI event filters, consumers, or their binding.