WMI Event Subscription Created Remotely

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the remote creation of a WMI event subscription, specifically looking for '__EventFilter' and 'CommandLineEventConsumer' within TCP traffic on port 445. This activity is often associated with persistence mechanisms used by attackers.