19 Sysmon log · WmiEvent high severity low volume

Sysmon Event ID 19 — WmiEventFilter activity detected

A WMI event filter was registered. Name and Query are key. WMI filters define when WMI consumers trigger.

Why event 19 matters

WMI persistence (T1546.003) — attackers create WMI event filters+consumers for persistent code execution. Survives reboots. Very hard to detect without Sysmon 19/20/21. Filter defines trigger (e.g., SystemTime query or Win32_ProcessStartTrace).

How to detect it

Alert: any new WMI filter registration outside of known management software. Correlate with Sysmon 20 (consumer) and 21 (binding) to understand the full persistence mechanism.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Persistence WMI Event Subscription (T1546.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: WMI Event Filter Registered
status: stable
description: WMI event filter registration — possible persistence
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 19
    condition: selection
falsepositives:
    - Legitimate WMI management software
    - SCCM/MECM
level: high
tags:
    - attack.persistence
    - attack.t1546.003
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 19   // WmiEventFilter activity detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=19
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# WmiEventFilter activity detected — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 19 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related WmiEvent events

20 WmiEventConsumer activity detected 21 WmiEventConsumerToFilter activity detected

Frequently asked questions

What is Sysmon Event ID 19?

WmiEventFilter activity detected. A WMI event filter was registered. Name and Query are key. WMI filters define when WMI consumers trigger.

Which log records event 19?

Event 19 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 19?

Event 19 is associated with: WMI Event Subscription (T1546.003).

How do you detect activity around event 19?

Alert: any new WMI filter registration outside of known management software. Correlate with Sysmon 20 (consumer) and 21 (binding) to understand the full persistence mechanism.