5860 WMI-Activity log · WMI Subscription medium severity low volume

WMI-Activity Event ID 5860 — Temporary WMI event consumer registered

A temporary (session-scoped) WMI event subscription was registered, recording the query and the registering user. Temporary consumers exist only while the registering process runs.

Why event 5860 matters

Temporary subscriptions back interactive tooling and some triggered-execution attacks. Less durable than permanent consumers (5861) but still used to run code on events such as process start or logon.

How to detect it

Capture the ESS query and registering process. Flag ActiveScript/CommandLine consumers and subscriptions created by script interpreters. Correlate with 5861 for the persistence pattern.

Log source
Microsoft-Windows-WMI-Activity/Operational
Enable/collect the WMI-Activity/Operational channel (on by default) to capture WMI provider and subscription activity.
Fields to pivot on
ESSQueryUserPossibleCause

MITRE ATT&CK mapping

Tactic Technique
Persistence Windows Management Instrumentation Event Subscription (T1546.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Temporary WMI Event Consumer Registered
status: experimental
logsource:
  product: windows
  service: wmi
detection:
  sel:
    EventID: 5860
  condition: sel
level: medium
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-WMI-Activity/Operational" and EventID == 5860   // Temporary WMI event consumer registered
// EventData holds: ESS, Query, User, PossibleCause
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" EventCode=5860
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Temporary WMI event consumer registered — add EventData fields: ESS, Query, User, PossibleCause`
Hunt event 5860 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related WMI Subscription events

5861 Permanent WMI event consumer registered

Frequently asked questions

What is WMI-Activity Event ID 5860?

Temporary WMI event consumer registered. A temporary (session-scoped) WMI event subscription was registered, recording the query and the registering user. Temporary consumers exist only while the registering process runs.

Which log records event 5860?

Event 5860 is written to the Microsoft-Windows-WMI-Activity/Operational channel by Microsoft-Windows-WMI-Activity. Enable/collect the WMI-Activity/Operational channel (on by default) to capture WMI provider and subscription activity.

What MITRE ATT&CK techniques map to event 5860?

Event 5860 is associated with: Windows Management Instrumentation Event Subscription (T1546.003).

How do you detect activity around event 5860?

Capture the ESS query and registering process. Flag ActiveScript/CommandLine consumers and subscriptions created by script interpreters. Correlate with 5861 for the persistence pattern.