Sysmon Event ID 21 — WmiEventConsumerToFilter activity detected — SecOps Tools

Why event 21 matters

The completion of WMI persistence setup. When filter+consumer+binding exist together, the mechanism is active. This binding event confirms the persistence is operational.

How to detect it

Alert on every occurrence. Investigate the associated filter (Sysmon 19) and consumer (Sysmon 20) to understand the full attack.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Persistence	WMI Event Subscription (T1546.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: WMI Persistence — Filter-Consumer Binding
status: stable
description: WMI filter bound to consumer — persistence mechanism active
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 21
    condition: selection
falsepositives:
    - Legitimate WMI management tools
level: high
tags:
    - attack.persistence
    - attack.t1546.003

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 21   // WmiEventConsumerToFilter activity detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=21
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# WmiEventConsumerToFilter activity detected — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 21 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related WmiEvent events

19 WmiEventFilter activity detected 20 WmiEventConsumer activity detected

Frequently asked questions

What is Sysmon Event ID 21?

WmiEventConsumerToFilter activity detected. A WMI filter was bound to a consumer. This completes the WMI persistence triad (filter+consumer+binding).

Which log records event 21?

Event 21 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 21?

Event 21 is associated with: WMI Event Subscription (T1546.003).

How do you detect activity around event 21?

Alert on every occurrence. Investigate the associated filter (Sysmon 19) and consumer (Sysmon 20) to understand the full attack.