T1546.003PersistenceAdvanced

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 12, 2026·37 min read

Windows Management Instrumentation (WMI) event subscription writes the __EventFilter (WQL trigger), __EventConsumer (command/script payload), and __FilterToConsumerBinding triplet persistently into the root\\subscription CIM repository, providing a backdoor that runs with SYSTEM privileges and leaves no traditional autorun trace on disk. For detection, Sysmon EID 19/20/21 and WMI-Activity EID 5861 form the primary signature layer; process tree anomaly and subscription hunting form the behavioral layer.

Exploit

Prevention

Detection

Defense profile:3 detection rules 4 mitigations 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

> Purpose and scope. This article provides a comprehensive map of WMI Event Subscription-based persistence for authorized penetration testing, red/purple team exercises, and

> defense (SOC/DFIR) teams: how it works → how to detect it → how to prevent it. Content

> is intended for educational and defensive purposes; detailed attack setup commands are in the Lab Appendix and

> must only be used in environments with explicit written authorization.

> Scope: This article covers WMI Event Subscription persistence in Windows endpoint and server (including on-prem and hybrid) environments.

> Azure/cloud-native WMI surface, macOS/Linux WMI equivalents, and non-WMI COM-based persistence (T1546.015) are outside the scope of this article.

Executive Summary

Windows Management Instrumentation (WMI) is a powerful infrastructure that has existed since Windows 98,

designed to manage the operating system and remote systems. It is a legitimate tool for administrators and developers; however, the same flexibility

offers attackers a persistence and execution mechanism that is by design.

WMI's event infrastructure allows linking a trigger to an action.

By persistently writing three components into the WMI repository (CIM repository — Common Information Model repository),

an attacker can establish a backdoor that survives even system restarts, runs with SYSTEM privileges,

and leaves no traditional "autorun" trace on disk:

__EventFilter — trigger condition (WQL query). E.g., "~1200 seconds after startup".
__EventConsumer — the action to execute when triggered (command line or script).
__FilterToConsumerBinding — the record that binds the filter to the consumer.

This technique is classified in MITRE ATT&CK as T1546.003 (Event Triggered Execution: WMI Event Subscription —

Event Triggered Execution: WMI Event Subscription) and appears under both Persistence and

Privilege Escalation tactics. WMI is also used for **remote command execution and lateral

movement** (T1047); this article focuses primarily on persistence and secondarily on

execution/lateral movement.

> Core thesis. WMI persistence evades signature-centric detection that relies on scanning

> executables on disk or registry ASEPs. Reliable detection depends on the behavioral layer

> (process tree, consumer anomaly, WMI telemetry correlation) and the

> signature layer (Sysmon EID 19/20/21, WMI-Activity EID 5861) working together.

> Without Sysmon or when the WMI-Activity log is not flowing to the SIEM, this technique remains largely

> invisible.

Creating a persistent __FilterToConsumerBinding requires local administrator (local admin) privileges;

therefore the least privilege principle is an important layer — but once admin is obtained, the detection and hunting layers come into play.

WMI Architecture

Understanding the attack requires clarifying WMI's layered structure.

CIM repository. WMI conforms to the CIM (Common Information Model)

industry standard; CIM is developed by DMTF. The repository holds queryable static

data that persists across restarts — which is exactly what makes it interesting to attackers.

Providers and classes. The Win32 provider offers rich information about the system via classes such as Win32_Process (process),

Win32_Service (service), Win32_LogonSession (session), Win32_Account.

WQL (WMI Query Language). Events are filtered with WQL; WQL is a

subset of SQL. Event queries define triggers using the SELECT * FROM ... WITHIN n WHERE ... pattern.

#### Intrinsic and extrinsic events

WMI produces two types of events:

Intrinsic events are created by a change in the WMI model — __InstanceCreationEvent when a class instance

is created, __InstanceModificationEvent when modified.

Intrinsic events require polling; this is why the WITHIN n (poll every n seconds) clause

appears in WQL.

Extrinsic events are events that cannot be directly bound to changes in repository objects —

for example, RegistryKeyChangeEvent notifies when a registry key changes.

The most commonly seen pattern in attack scenarios is an intrinsic event based on system uptime:

-- Defense analysis reference — pattern triggered when system has been up ~1200 seconds
SELECT * FROM __InstanceModificationEvent WITHIN 5
WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
  AND TargetInstance.SystemUpTime >= 1200

Why is this pattern common? Because the payload silently executes shortly after every restart —

no user interaction required. An attacker may also write the trigger to unusual namespaces such as

root\Default to reduce the detection footprint.

The Three Components of a Subscription — T1546.003

Component	WMI class	Role
Event filter	`__EventFilter`	Trigger — WQL query defining the event of interest
Event consumer	`__EventConsumer` (subclasses)	Action — the command/script to execute when triggered
Binding	`__FilterToConsumerBinding`	The record that binds the filter to the consumer

The binding answers: "On which Windows event (filter) should I run which program (consumer)?"

These three objects are typically written to the root\subscription namespace.

Installation can be done via a PowerShell Set-WmiInstance call, compiling a MOF file with

mofcomp.exe, or directly via WMI COM interfaces. Full command examples are in the Lab Appendix.

#### Consumer types

WMI has five standard consumer classes: CommandLineEventConsumer,

ActiveScriptEventConsumer, LogFileEventConsumer, NTEventLogEventConsumer,

SMTPEventConsumer. In real attacks the first two dominate:

CommandLineEventConsumer — spawns a process when triggered. The CommandLineTemplate

property specifies the command to run, ExecutablePath specifies the absolute path. Typical payload:

a directly executable binary or rundll32.exe / powershell.exe with encoded script

parameters. Microsoft Learn approved source: Wbemcons.dll.

ActiveScriptEventConsumer — executes via a script path on disk or directly via script text

(ScriptText). Only VBScript or JScript is supported (PowerShell

is not supported). When it runs, it spawns the rarely seen scrcons.exe process (official Microsoft

name: "WMI Standard Event Consumer - Scripting Application").

> SYSTEM privileges. WMI consumers run in the SYSTEM context. This means the technique carries

> an Admin-to-SYSTEM escalation effect in addition to persistence.

#### Evasion methods

Attackers use various evasion approaches to complicate detection:

Using the root\Default namespace instead of the standard root\subscription.
Choosing names similar to legitimate consumer names — for example, a name resembling the real "SCM Event Log Consumer"

(a general TTP documented in security community research reports;

claims tied to specific malware must be verified from primary sources).

Preferring PowerShell WMI cmdlets over monitored tools (wmic.exe).
Direct WMI COM calls that leave less trace than CreateInstance.

#### Historical context: Stuxnet and beyond

WMI event subscription-based persistence is a mature technique. Stuxnet (approx. 2010)

is cited by researchers as one of the early examples of WMI event consumers being used for persistence in the wild; the campaign is reported to have used a winsta.exe payload and a MOF file named sysnullevnt.mof

to create a WMI subscription (source:

Matt Graeber, Black Hat 2015 WMI research paper and ESET "Stuxnet Under the Microscope").

In subsequent years, numerous malware families including ransomware and crypto-worms

have been documented by researchers as having adopted this pattern.

#### Remote execution and lateral movement via WMI — T1047

WMI is used not only for persistence but also for remote command execution and lateral movement (T1047).

The Win32_Process.Create method can start processes on remote systems. The core process for remote WMI

actions is WmiPrvSE.exe; WmiPrvSE.exe spawning powershell.exe

is a typical attack signature. Publicly available tools: Impacket wmiexec,

PowerShell WMI cmdlets (Invoke-WmiMethod), wmic.

Lab Appendix (authorized test environment only)

> This section is for explicitly authorized lab/penetration testing environments only.

# Authorized test environment — PowerShell subscription setup flow (inspired by ired.team example)
$ns = 'root\subscription'

# 1) Filter (trigger)
$Filter = Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{
  Name             = 'backdoor'
  EventNamespace   = 'root\CIMV2'
  QueryLanguage    = 'WQL'
  Query            = "SELECT * FROM __InstanceModificationEvent WITHIN 5 " +
                     "WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' " +
                     "AND TargetInstance.SystemUpTime >= 1200"
}

# 2) Consumer (action)
$Consumer = Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{
  Name           = 'backdoor'
  ExecutablePath = 'C:\test\backdoor.exe'
}

# 3) Binding
Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{
  Filter   = $Filter
  Consumer = $Consumer
}

// Authorized test environment — conceptual MOF skeleton (root\subscription)
#PRAGMA NAMESPACE("\\\\.\\root\\subscription")
instance of __EventFilter as $Filter {
  Name           = "GenericFilter";
  QueryLanguage  = "WQL";
  Query          = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE ...";
};
instance of CommandLineEventConsumer as $Consumer {
  Name                = "GenericConsumer";
  CommandLineTemplate = "C:\\Windows\\test.exe";
};
instance of __FilterToConsumerBinding {
  Filter   = $Filter;
  Consumer = $Consumer;
};

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

WMI persistence relies on a critical prerequisite from a prevention standpoint: creating a persistent

__FilterToConsumerBinding requires local administrator privileges. The following

controls must work in an integrated manner; local admin can be obtained (credential harvesting,

privilege escalation) and legitimate management requirements may necessitate admin access.

What is not covered: The following controls do not automatically clean up existing, previously placed subscriptions;

regular active hunting and allowlist validation close this gap.

Prioritized Control Checklist

#	Control	Plain statement
1	Least privilege	Limit local administrator and SYSTEM access; tier privileged accounts. Since admin is required for a persistent subscription, this is the strongest prevention layer — once admin is obtained, the detection layer takes over.
2	Sysmon EID 19/20/21 + alerting	Because volume is low, it is practical to alert on every consumer/filter/binding creation event; forward the Sysmon configuration to a central SIEM.
3	Collect WMI-Activity/Operational logs	Send EID 5861 to the SIEM; periodically scan `root\subscription` + `root\Default`.
4	Allowlist-based persistence hunting	Enumerate legitimate consumers in the environment, hunt for anomalies at scale; audit the allowlist regularly.
5	Restrict WMI/DCOM remote access	Limit remote WMI/DCOM access to required hosts/accounts; restrict WinRM/remote WMI with firewall rules.
6	Command-line auditing	Since WMIC/remote WMI command lines do not appear in the WMI-Activity log, enable process creation + command-line auditing in the Security log or Sysmon EID 1.

Cleaning Up Existing Subscriptions

When a suspicious subscription is detected, find the filter and binding by consumer name,

then delete all of them:

# Find and delete a suspicious consumer (authorized IR environment)
$ns = 'root\Subscription'
$name = 'backdoor'  # replace with the detected consumer name

# Delete the binding
Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding |
  Where-Object { $_.Consumer -like "*$name*" } | Remove-WmiObject

# Delete the consumer
Get-WmiObject -Namespace $ns -Class __EventConsumer |
  Where-Object { $_.Name -eq $name } | Remove-WmiObject

# Delete the filter
Get-WmiObject -Namespace $ns -Class __EventFilter |
  Where-Object { $_.Name -eq $name } | Remove-WmiObject

MITRE ATT&CK Mapping

T1546.003 — Event Triggered Execution: WMI Event Subscription (primary; Persistence +

Privilege Escalation tactics). Verified: attack.mitre.org/techniques/T1546/003/

T1047 — Windows Management Instrumentation (remote execution / lateral movement; Execution

tactic). Verified: attack.mitre.org/techniques/T1047/

Related persistence neighbor: T1546.015 — COM Object Hijacking (a separate article topic).

References

MITRE ATT&CK: T1546.003 — https://attack.mitre.org/techniques/T1546/003/ ;

T1047 — https://attack.mitre.org/techniques/T1047/

Microsoft Learn — CommandLineEventConsumer (Wbemcons.dll); ActiveScriptEventConsumer

(Scrcons.exe); __EventFilter, __FilterToConsumerBinding class documentation;

MOF (mofcomp.exe) references.

Microsoft — Sysmon (Sysinternals), EID 19/20/21 (WmiEventFilter/Consumer/ConsumerToFilter).
DarkOperator — "Sysinternals Sysmon 6.10 — Tracking of Permanent WMI Events" (2017-10-15).

https://www.darkoperator.com/blog/2017/10/15/sysinternals-sysmon-610-tracking-of-permanent-wmi-events

Matthew Graeber — "Abusing Windows Management Instrumentation (WMI) to Build a Persistent,

Asynchronous, and Fileless Backdoor", Black Hat USA 2015.

ired.team — "Abusing Windows Management Instrumentation" (WMI persistence setup

steps). https://www.ired.team/offensive-security/persistence/t1084-abusing-windows-managent-instrumentation

Sigma — Tom Ueltschi (@c_APT_ure) WMI Event Subscription rule (id: 0f06a3a5...);

Florian Roth SigmaHQ. https://github.com/Neo23x0/sigma

Tools: Impacket wmiexec, Sysinternals Autoruns/Autorunsc,

Velociraptor (PermanentWMIEvents artifact), Kansa, OSQuery.

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

WMI was a blind spot in enterprises for a long time; Sysmon EID 19/20/21 and WMI-Activity/Operational

logs changed this significantly. However, detection should not rely solely on these signatures.

Layer 1 — Event Log Signatures (Primary Trigger)

#### Sysmon EID 19 / 20 / 21

In 2017, Sysmon 6.10 added three event IDs specific to WMI events (DarkOperator,

"Sysinternals Sysmon 6.10 — Tracking of Permanent WMI Events", 2017-10-15):

Sysmon EID	Official name	WMI component
19	WmiEvent (WmiEventFilter activity detected)	`__EventFilter` creation
20	WmiEvent (WmiEventConsumer activity detected)	`__EventConsumer` creation
21	WmiEvent (WmiEventConsumerToFilter activity detected)	`__FilterToConsumerBinding` creation

> Note: Sysmon only logs ActiveScriptEventConsumer and CommandLineEventConsumer

> types — these are the two primary consumer types used in attacks.

These events are low-volume; it is practical to enable them, centralize them, and alert on each one.

title: WMI Event Subscription
id: 0f06a3a5-6a09-413f-8743-e6cf35561297
status: experimental
description: WMI kalıcı olay aboneliği oluşturulmasını tespit eder
references:
  - https://attack.mitre.org/techniques/T1546/003/
tags:
  - attack.t1546.003
  - attack.persistence
author: Tom Ueltschi (@c_APT_ure)
logsource:
  product: windows
  service: sysmon
detection:
  selector:
    EventID:
      - 19
      - 20
      - 21
  condition: selector
falsepositives:
  - Ortamınızdaki onaylı meşru WMI aboneliklerini izin listesine alın
level: high

#### WMI-Activity/Operational EID 5861 / 5857 / 5858

With Windows's advanced logging infrastructure, the Microsoft-Windows-WMI-Activity/Operational

log provides detailed records for the WMI event infrastructure:

EID 5861 — new persistent consumer. The most valuable event; records every persistent consumer

added to the repository. Look for suspicious keywords such as powershell, eval, .vbs, .ps1, ActiveXObject, CommandLineTemplate,

ScriptText.

EID 5857 — tracks loaded provider DLLs. wbemcons.dll is loaded into WmiPrvSE.exe when a

CommandLineEventConsumer starts — this load is extremely rare on most systems and warrants investigation when seen.

EID 5858 — records ClientMachine and User information on WMI query errors; useful for querying

remote WMI / lateral movement traces against known bad hosts/accounts.

> What this layer does not cover. Sysmon EID 19/20/21 only captures **new subscription

> creation**; it does not capture the triggering moment or payload behavior. The WMI-Activity

> log does not record WMIC/remote WMI command lines; Security log process creation auditing or Sysmon EID 1 is required for that data.

Layer 2 — Behavioral Layer (PRIMARY Validation)

When the signature layer fires positive, behavioral indicators strengthen context; they also compensate for signature misses:

Process tree anomaly. The WmiPrvSE.exe → powershell.exe relationship (especially with encoded

parameters) is a strong signal. scrcons.exe (ActiveScript consumer process) is rare on most

systems — always investigate when seen.

Consumer anomaly. Once a consumer baseline is established for the environment, any

new consumer not on the legitimate list triggers an immediate alert; name similarity analysis (e.g., "SCM Event Consumer" vs

legitimate "SCM Event Log Consumer") is applied.

Payload content. In EID 5861/Sysmon EID 20 output, unusual paths, encoded scripts, or ActiveXObject usage in the CommandLineTemplate, ExecutablePath

or ScriptText fields.

Volume/frequency. A large number of subscription creations in a short time; EID 19+20+21 clustered simultaneously.

Layer 3 — Subscription Hunting: `root\subscription` and `root\Default`

Hunt for suspicious subscriptions with regular PowerShell scanning (or at scale with Velociraptor).

Query both namespaces — attackers may shift to root\Default as monitoring increases:

# IR / threat hunting — both namespaces scanned
foreach ($ns in 'root\Subscription', 'root\Default') {
    Write-Host "=== $ns ==="
    Get-WmiObject -Namespace $ns -Class __EventFilter
    Get-WmiObject -Namespace $ns -Class __EventConsumer
    Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding
}

When hunting, focus on consumers: consumers carry payload data such as CommandLineTemplate, ExecutablePath,

ScriptText and are higher value compared to filters/bindings.

#### Allowlist-based anomaly hunting

Almost every system has a small number of predictable legitimate WMI consumers. As a starting

reference, known legitimate consumers include: SCM Event Log Consumer, BVTFilter,

TSLogonEvents.vbs, TSLogonFilter, RAevent.vbs, RmAssistEventFilter, KernCap.vbs,

NTEventLogConsumer, WSCEAA.exe (Dell). Warning: Audit the allowlist periodically;

attackers attempt to blend in with similar names, and legitimate scripts such as KernCap.vbs can be replaced with malicious content under the same name.

#### Helper tools

Autoruns/Autorunsc (Sysinternals) lists subscriptions in the WMI tab; Velociraptor

provides the PermanentWMIEvents artifact; Kansa collects at scale with its PowerShell framework;

OSQuery queries the wmi_cli_event_consumers, wmi_script_event_consumers, wmi_event_filters,

wmi_filter_consumer_bindings tables.

Attack → Detection Matrix

Attack step (MITRE)	Prerequisite	Primary detection
`__EventFilter` creation `T1546.003`	Local admin	Sysmon EID 19
`__EventConsumer` (CommandLine/ActiveScript) `T1546.003`	Local admin	Sysmon EID 20, WMI-Activity EID 5861
`__FilterToConsumerBinding` `T1546.003`	Local admin	Sysmon EID 21
MOF + `mofcomp.exe` registration `T1546.003`	Local admin	`.mof` creation / `mofcomp` execution (Sysmon EID 1/11)
ActiveScript execution `T1546.003`	Trigger met	`scrcons.exe` process; `wbemcons.dll` load (EID 5857)
Remote WMI execution / lateral movement `T1047`	Valid credential + remote WMI	WMI-Activity EID 5858 (host/user); `WmiPrvSE.exe→powershell.exe`

Information note

WMI event subscriptions (MITRE T1546.003) are a stealthy persistence mechanism that survives system reboots. Because the EventFilter, EventConsumer, and FilterToConsumerBinding triad is created in the root\subscription namespace, it cannot be detected by auditing traditional startup locations. Sysmon 6.10+ records these subscriptions via Event ID 19/20/21. Periodically audit existing subscriptions with Get-WMIObject -Namespace root\subscription and remove any unexpected entries.

WMI Event Subscription Persistence Detection (Sysmon EID 19/20/21)

Detects the registration of WMI persistent event subscription components (EventFilter, EventConsumer, FilterToConsumerBinding) by monitoring Sysmon EID 19 (WmiEventFilter), 20 (WmiEventConsumer), and 21 (WmiEventConsumerToFilter) events. Targets the fileless persistence technique used by advanced threat actors such as APT29, Turla, and FIN8.

medium

sigmaExperimental

Show ruleHide rule

title: WMI Event Subscription Persistence via Sysmon Events
id: 0f06a3a5-6a09-413f-8743-e6cf35561298
status: experimental
description: |
  Detects WMI permanent event subscription components being registered, using
  Sysmon EID 19 (EventFilter), 20 (EventConsumer), and 21 (FilterToConsumerBinding).
  Adversaries create all three to establish fileless or stealthy persistence
  executed under WmiPrvSe.exe (SYSTEM). Used by APT29, APT33, Turla, FIN8.
  Rule broadly flags all three subscription events — tune by adding environment
  baselines for known-good subscriptions. AI-generated / unvalidated.
references:
  - https://attack.mitre.org/techniques/T1546/003/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml
  - https://www.elastic.co/guide/en/security/current/suspicious-wmi-event-subscription-created.html
  - https://detection.fyi/sigmahq/sigma/windows/wmi_event/sysmon_wmi_event_subscription/
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.t1546.003
  - attack.persistence
  - attack.privilege_escalation
logsource:
  product: windows
  category: wmi_event
detection:
  selection_sysmon_wmi:
    EventID:
      - 19
      - 20
      - 21
  filter_main_scm_health:
    Consumer|contains:
      - 'SCM Event Log Consumer'
      - 'NTEventLogEventConsumer'
    Filter|contains: 'SCM Event Provider'
  filter_optional_sccm:
    Consumer|contains:
      - 'SCCM'
      - 'ConfigMgr'
  condition: selection_sysmon_wmi and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - SCCM ve HP SIM gibi kurumsal yönetim araçları meşru WMI abonelikleri kullanır
  - Bazı antivirüs/EDR ürünleri izleme amaçlı WMI event filter/consumer oluşturabilir
  - Microsoft'un SCM Event Log Consumer gibi yerleşik Windows abonelikleri
level: medium

Not validated

Telemetry required to run: WMI Eventwindows/wmi_event (Sysmon EID 19 — WmiEventFilter, EID 20 — WmiEventConsumer, EID 21 — WmiEventConsumerToFilter)Windows

False positive: Enterprise management tools such as SCCM and HP SIM, as well as some antivirus/EDR solutions, may create legitimate WMI subscriptions; the Microsoft built-in SCM Event Log Consumer also falls within this scope.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Information note

Informational note: WMI event subscriptions (MITRE T1546.003) are one of the preferred vectors for stealthy persistence; they trigger on reboot and leave no trace on the file system. Sysmon EID 19/20/21 records EventFilter, EventConsumer, and their Binding respectively. Observing all three events together is a strong attack indicator. Cross-validation should be performed against EID 5861 in the WMI-Activity/Operational log.

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding

Zafiyet (Vulnerability)

Executive Summary

WMI Architecture

The Three Components of a Subscription — T1546.003

Lab Appendix (authorized test environment only)

Prevention & Hardening

Prioritized Control Checklist

Cleaning Up Existing Subscriptions

MITRE ATT&CK Mapping

References

Detection

Layer 1 — Event Log Signatures (Primary Trigger)

Layer 2 — Behavioral Layer (PRIMARY Validation)

Layer 3 — Subscription Hunting: `root\subscription` and `root\Default`

Attack → Detection Matrix

Detection rules

WMI Backdoor Exchange Transport Agent

Mitigations

Behavior Prevention on Endpoint

Privileged Account Management

Response playbooks

Techniques in the Persistence tactic

References

WMI Operational Log — CommandLine/ActiveScript Consumer Detection

WMI Event Subscription Persistence Detection (Sysmon EID 19/20/21)

Update Software

User Account Management

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Large-Scale DFIR Hunt with Velociraptor (Multi-Endpoint / Active Breach)

WMI Event Subscription Persistence — Active Payload / Lateral Movement Response

WMI Event Subscription Persistence — Suspicious Subscription Response (Payload Not Active)

WMI Event Subscription Persistence: Hidden Backdoors with __EventFilter / __EventConsumer / __FilterToConsumerBinding

Executive Summary

WMI Architecture

The Three Components of a Subscription — T1546.003

Lab Appendix (authorized test environment only)

Prioritized Control Checklist

Cleaning Up Existing Subscriptions

MITRE ATT&CK Mapping

References

Layer 1 — Event Log Signatures (Primary Trigger)

Layer 2 — Behavioral Layer (PRIMARY Validation)

Layer 3 — Subscription Hunting: root\subscription and root\Default

Attack → Detection Matrix

Detection rules

WMI Backdoor Exchange Transport Agent

Mitigations

Behavior Prevention on Endpoint

Privileged Account Management

Response playbooks

Techniques in the Persistence tactic

References

WMI Operational Log — CommandLine/ActiveScript Consumer Detection

WMI Event Subscription Persistence Detection (Sysmon EID 19/20/21)

Update Software

User Account Management

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Large-Scale DFIR Hunt with Velociraptor (Multi-Endpoint / Active Breach)

WMI Event Subscription Persistence — Active Payload / Lateral Movement Response

WMI Event Subscription Persistence — Suspicious Subscription Response (Payload Not Active)

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding

Layer 3 — Subscription Hunting: `root\subscription` and `root\Default`