A WMI event consumer was registered. Destination (CommandLineEventConsumer) or ActiveScriptEventConsumer shows the payload.
The payload side of WMI persistence. CommandLineEventConsumer shows the command to execute. ActiveScriptEventConsumer shows the script. This reveals exactly what the attacker's persistence mechanism will execute.
Alert: consumer with CommandLine containing PowerShell, cmd, or suspicious paths. Alert: ActiveScript consumers. Correlate with Sysmon 19 (filter) and 21 (binding).
ImageCommandLineParentImageUserHashes | Tactic | Technique |
|---|---|
| Persistence | WMI Event Subscription (T1546.003) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 20 // WmiEventConsumer activity detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=20
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# WmiEventConsumer activity detected — add EventData fields: Image, CommandLine, ParentImage, User`
WmiEventConsumer activity detected. A WMI event consumer was registered. Destination (CommandLineEventConsumer) or ActiveScriptEventConsumer shows the payload.
Event 20 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Event 20 is associated with: WMI Event Subscription (T1546.003).
Alert: consumer with CommandLine containing PowerShell, cmd, or suspicious paths. Alert: ActiveScript consumers. Correlate with Sysmon 19 (filter) and 21 (binding).