win:sysmon 19
WmiEvent (WmiEventFilter activity detected)
When a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- Sigma 3, Microsoft Sentinel 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Listed | |
| Windows member server | Listed | |
| Windows domain controller | Listed | |
| Windows web server (IIS), internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event.
Rules that depend on it
Sigma 3
- Suspicious Encoded Scripts in a WMI Consumer by Florian Roth (Nextron Systems)
- Suspicious Scripting in a WMI Consumer by Florian Roth (Nextron Systems), Jonhnathan Ribeiro
- WMI Event Subscription by Tom Ueltschi (@c_APT_ure)
Microsoft Sentinel 1
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | pySigma-backend-kusto: wmi -> DeviceEvents; our analysis: WMI persistence is reported as ActionTypes, not one per Sysmon event |