Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › WMI Event Subscription Persistence

WMI Event Subscription Persistence

3 min read

Jump to:

Overview

WMI Event Subscription Persistence is a technique where adversaries leverage Windows Management Instrumentation (WMI) event subscriptions to maintain persistent access on a compromised system. By registering event consumers and filters, attackers can execute code or trigger actions in response to specific system events, enabling stealthy and resilient persistence mechanisms throughout the attack lifecycle.

Attack Objective

Establish and maintain covert persistence on a target system
Supports Persistence, Execution, and Defense Evasion stages of the attack lifecycle
Allows attackers to execute payloads automatically in response to system events, advancing control and stealth

How the Technique Works

Adversaries create or modify WMI event subscriptions, which consist of event filters and event consumers. Event filters specify the conditions or triggers (such as system startup or process creation), while event consumers define the actions to execute when those conditions are met. This mechanism enables code execution without relying on traditional startup locations or scheduled tasks, often evading detection by blending into legitimate system activity.

Common Methods & Variations

Creation of permanent or temporary WMI event filters and consumers using WMI scripting or command-line tools
Use of __EventFilter, __EventConsumer, and __FilterToConsumerBinding WMI classes to link triggers and actions
Variations include execution of scripts, launching binaries, or invoking PowerShell commands
Primarily observed on endpoint systems running Windows OS; less common in cloud or network environments
Often implemented using living-off-the-land techniques leveraging built-in Windows utilities and WMI infrastructure

Indicators of Compromise (IOCs)

Presence of unusual or unauthorized WMI event subscriptions in the repository
Event logs showing WMI consumer execution or related process launches triggered by WMI events
Artifacts such as suspicious WMI filter or consumer objects created or modified outside normal administrative activity
Endpoint telemetry capturing WMI repository changes or anomalous WMI-related process behavior

Detection Strategies

Monitoring WMI repository for creation or modification of event filters, consumers, and bindings
Behavioral detection of processes launched via WMI event consumers, especially those executing scripts or unknown binaries
Correlation of WMI event subscription changes with other suspicious activity or unauthorized privilege use
Use of Windows Event Logs (e.g., Microsoft-Windows-WMI-Activity/Operational) and Sysmon events for visibility

Mitigation & Prevention

Restrict permissions to modify WMI namespaces and event subscriptions to trusted administrators
Implement application whitelisting to control execution of unauthorized scripts or binaries triggered by WMI
Regularly audit WMI repository for unauthorized event subscriptions and remove suspicious entries
Enforce least privilege principles and monitor for privilege escalation attempts related to WMI

Response Considerations

Immediately disable or remove suspicious WMI event subscriptions to interrupt persistence
Investigate the scope of WMI modifications and associated processes or payloads executed
Perform forensic analysis of WMI repository and related logs to identify attacker activity timeline
Harden WMI permissions and apply security patches to prevent re-establishment of persistence

Related Techniques

Scheduled Task/Job Persistence – alternative persistence mechanisms triggered by system events
Registry Run Keys / Startup Folder – other common persistence methods
PowerShell Event Subscription – similar event-driven execution leveraging PowerShell
Process Injection – often combined with WMI-triggered payload execution

Mapping & References

MITRE ATT&CK Tactic: Persistence, Execution, Defense Evasion
MITRE ATT&CK Technique: T1546.003 – Event Triggered Execution: Windows Management Instrumentation Event Subscription
Public research and advisories on WMI persistence techniques from cybersecurity vendors and incident reports

Tags: ATT&CK T1546.003 Defense Evasion Detection endpoint security Event Subscription Execution Mitigation persistence Windows WMI