A temporary (session-scoped) WMI event subscription was registered, recording the query and the registering user. Temporary consumers exist only while the registering process runs.
Temporary subscriptions back interactive tooling and some triggered-execution attacks. Less durable than permanent consumers (5861) but still used to run code on events such as process start or logon.
Capture the ESS query and registering process. Flag ActiveScript/CommandLine consumers and subscriptions created by script interpreters. Correlate with 5861 for the persistence pattern.
ESSQueryUserPossibleCause | Tactic | Technique |
|---|---|
| Persistence | Windows Management Instrumentation Event Subscription (T1546.003) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Temporary WMI Event Consumer Registered
status: experimental
logsource:
product: windows
service: wmi
detection:
sel:
EventID: 5860
condition: sel
level: medium
Event
| where EventLog == "Microsoft-Windows-WMI-Activity/Operational" and EventID == 5860 // Temporary WMI event consumer registered
// EventData holds: ESS, Query, User, PossibleCause
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" EventCode=5860
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Temporary WMI event consumer registered — add EventData fields: ESS, Query, User, PossibleCause`
Temporary WMI event consumer registered. A temporary (session-scoped) WMI event subscription was registered, recording the query and the registering user. Temporary consumers exist only while the registering process runs.
Event 5860 is written to the Microsoft-Windows-WMI-Activity/Operational channel by Microsoft-Windows-WMI-Activity. Enable/collect the WMI-Activity/Operational channel (on by default) to capture WMI provider and subscription activity.
Event 5860 is associated with: Windows Management Instrumentation Event Subscription (T1546.003).
Capture the ESS query and registering process. Flag ActiveScript/CommandLine consumers and subscriptions created by script interpreters. Correlate with 5861 for the persistence pattern.