Sigma rule: WMI Persistence

Rule

Title

WMI Persistence

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community

Date

2017-08-22

Modified

2022-02-10

File

rules/windows/builtin/wmi/win_wmi_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Log source

product

windows

service

wmi

definition

WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher

Detection

wmi_filter_to_consumer_binding:
    EventID: 5861
consumer_keywords:
    - 'ActiveScriptEventConsumer'
    - 'CommandLineEventConsumer'
    - 'CommandLineTemplate'
    # - 'Binding EventFilter'  # too many false positive with HP Health Driver
wmi_filter_registration:
    EventID: 5859
filter_scmevent:
    Provider: 'SCM Event Provider'
    Query: 'select * from MSFT_SCMEventLogEvent'
    User: 'S-1-5-32-544'
    PossibleCause: 'Permanent'
condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent

False positives (as the rule lists them)

• Unknown (data set is too small; further testing needed)

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1546.003

MITRE ATT&CK ids this rule names

• T1546.003

References

• https://twitter.com/mattifestation/status/899646620148539397
• https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/wmi/win_wmi_persistence.yml