high Sigma Windows experimental

WMI Event Subscription Persistence

The FilterToConsumerBinding that turns WMI into fileless, reboot-surviving execution. Rare in most estates, which is exactly what makes it high-fidelity.

Rule source

wmi-event-subscription-persistence.yml

title: WMI Event Subscription Persistence
id: b71f5c19-2d8e-4c3f-9a07-7e6d1b4a2c58
status: experimental
description: >
  Creation of WMI consumers and filter-to-consumer bindings, the mechanism
  that turns WMI into fileless, reboot-surviving execution.
references:
  - https://attack.mitre.org/techniques/T1546/003/
author: DetectionOps
date: 2026/09/20
logsource:
  product: windows
  category: wmi_event
detection:
  consumer_created:
    EventID: 20
    Destination|contains:
      - 'CommandLineEventConsumer'
      - 'ActiveScriptEventConsumer'
  binding_created:
    EventID: 21
  filter_sccm:
    Name|startswith:
      - 'SCCM'
      - 'CCM_'
  condition: 1 of (consumer_created, binding_created) and not filter_sccm
fields:
  - Operation
  - User
  - Destination
  - Query
falsepositives:
  - Configuration Manager consumers - allowlist by name prefix
  - Dell and HP hardware monitoring agents
level: high
tags:
  - attack.persistence
  - attack.t1546.003

Required telemetry

Sysmon - Event IDs 19, 20, 21 (WmiEvent)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Configuration Manager consumers - allowlist by name prefix
Dell and HP hardware monitoring agents

Validation

Atomic Red Team T1546.003-1; verify cleanup removes the binding

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.