20 Sysmon log · WmiEvent high severity low volume

Sysmon Event ID 20 — WmiEventConsumer activity detected

A WMI event consumer was registered. Destination (CommandLineEventConsumer) or ActiveScriptEventConsumer shows the payload.

Why event 20 matters

The payload side of WMI persistence. CommandLineEventConsumer shows the command to execute. ActiveScriptEventConsumer shows the script. This reveals exactly what the attacker's persistence mechanism will execute.

How to detect it

Alert: consumer with CommandLine containing PowerShell, cmd, or suspicious paths. Alert: ActiveScript consumers. Correlate with Sysmon 19 (filter) and 21 (binding).

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Persistence WMI Event Subscription (T1546.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 20   // WmiEventConsumer activity detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=20
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# WmiEventConsumer activity detected — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 20 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related WmiEvent events

19 WmiEventFilter activity detected 21 WmiEventConsumerToFilter activity detected

Frequently asked questions

What is Sysmon Event ID 20?

WmiEventConsumer activity detected. A WMI event consumer was registered. Destination (CommandLineEventConsumer) or ActiveScriptEventConsumer shows the payload.

Which log records event 20?

Event 20 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 20?

Event 20 is associated with: WMI Event Subscription (T1546.003).

How do you detect activity around event 20?

Alert: consumer with CommandLine containing PowerShell, cmd, or suspicious paths. Alert: ActiveScript consumers. Correlate with Sysmon 19 (filter) and 21 (binding).