WMI Event Subscription Persistence — Active Payload / Lateral Movement Response
A WMI consumer is executing an active payload, a hidden root\Default subscription is present, or remote WMI/lateral movement is suspected; evidence-first isolation followed by full eradication in safe order.
Get-WMIObject queries should be run for post-cleanup verification.Prepare
5 steps- Sysmon WMI telemetry
EID 19/20/21 must be enabled and flowing to SIEM; EID 1/10 process creation and process access logs are critical to observe the `WmiPrvSE.exe → powershell.exe` chain
- WMI-Activity log
EID 5858 provides `ClientMachine` and `User` fields from remote WMI error records — the primary signal for lateral movement tracing; if this log is not flowing to SIEM, lateral movement remains largely invisible
- Memory and disk imaging capability
In WMI-based attacks, payload traces reside in memory and the CIM repository; an on-demand imaging tool must be ready (e.g., WinPMEM, FTK Imager, Velociraptor)
- Legitimate consumer allowlist
Same prerequisites as PB-A; the `root\Default` namespace must also be included in scope
- Escalation and authority chain
Active infection/lateral movement decisions require IR Lead / CISO approval; isolation and credential reset authority must be pre-defined