5861 WMI-Activity log · WMI Subscription high severity very-low volume

WMI-Activity Event ID 5861 — Permanent WMI event consumer registered

A permanent WMI event subscription binding (an __EventFilter bound to a __EventConsumer) was created. Permanent consumers survive reboots and run whenever their trigger fires.

Why event 5861 matters

A hallmark fileless persistence and execution technique (used by Turla, FIN groups, and common offensive toolkits). A CommandLineEventConsumer or ActiveScriptEventConsumer bound to a filter runs attacker code on triggers like logon or a time interval. Nearly every 5861 warrants review.

How to detect it

Alert on every 5861. Extract the consumer type and command/script. Allow-list legitimate sources (SCCM, monitoring agents). Correlate with 4688 for the process that created the binding.

Log source
Microsoft-Windows-WMI-Activity/Operational
Enable/collect the WMI-Activity/Operational channel (on by default) to capture WMI provider and subscription activity.
Fields to pivot on
ConsumerFilterQueryUser

MITRE ATT&CK mapping

Tactic Technique
Persistence Windows Management Instrumentation Event Subscription (T1546.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Permanent WMI Event Consumer Created
status: stable
logsource:
  product: windows
  service: wmi
detection:
  sel:
    EventID: 5861
  condition: sel
level: high
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-WMI-Activity/Operational" and EventID == 5861   // Permanent WMI event consumer registered
// EventData holds: Consumer, Filter, Query, User
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" EventCode=5861
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Permanent WMI event consumer registered — add EventData fields: Consumer, Filter, Query, User`
Hunt event 5861 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related WMI Subscription events

5860 Temporary WMI event consumer registered

Frequently asked questions

What is WMI-Activity Event ID 5861?

Permanent WMI event consumer registered. A permanent WMI event subscription binding (an __EventFilter bound to a __EventConsumer) was created. Permanent consumers survive reboots and run whenever their trigger fires.

Which log records event 5861?

Event 5861 is written to the Microsoft-Windows-WMI-Activity/Operational channel by Microsoft-Windows-WMI-Activity. Enable/collect the WMI-Activity/Operational channel (on by default) to capture WMI provider and subscription activity.

What MITRE ATT&CK techniques map to event 5861?

Event 5861 is associated with: Windows Management Instrumentation Event Subscription (T1546.003).

How do you detect activity around event 5861?

Alert on every 5861. Extract the consumer type and command/script. Allow-list legitimate sources (SCCM, monitoring agents). Correlate with 4688 for the process that created the binding.