WMI Event Subscription Persistence — Suspicious Subscription Response (Payload Not Active)
Sysmon EID 19/20/21 or WMI-Activity EID 5861 indicates suspicious WMI subscription creation but there is no evidence of active payload execution; the goal is to validate the consumer, secure evidence, and remove the triad in a safe sequence.
Prepare
5 steps- Sysmon WMI telemetry
Sysmon EID 19 (`__EventFilter`), EID 20 (`__EventConsumer`), and EID 21 (`__FilterToConsumerBinding`) must be enabled on endpoints and streaming to the central SIEM; these events are low-volume and an alert can be set for each
- WMI-Activity log
`Microsoft-Windows-WMI-Activity/Operational` EID 5861 (new persistent consumer), EID 5857 (wbemcons.dll load), and EID 5858 (remote WMI errors) must be centralized to SIEM
- Legitimate consumer allowlist
Known legitimate consumers in the environment (`SCM Event Log Consumer`, `BVTFilter`, `TSLogonEvents.vbs`, `RAevent.vbs`, `KernCap.vbs`, `NTEventLogConsumer`, `WSCEAA.exe`, etc.) must be documented and periodically updated; full-match checking against name-similarity attacks is required
- Process creation auditing
Sysmon EID 1 (with command line) or Security log 4688 must be enabled; WMIC/remote WMI command lines fall into this channel, not WMI-Activity
- Escalation definition
SOC L1 → L2/Endpoint Security → IR Lead → System Administrator chain is defined; classification decision (PB-A/PB-B) is not made by L1 alone — L2/IR approval is mandatory