Skip to content
Sign In
Telemetry

win:wmi 5861

5861

Log source
WMI Activity log
Host type
Windows (workstation, member server, domain controller)
Tier, host type
Recommended
Techniques
5
Rules depending on it
Splunk 1, Sigma 1

Why this tier

By role

RoleTierBasis
Windows workstationRecommended
Windows member serverRecommended
Windows domain controllerRecommended
Windows web server (IIS), internet-facingRecommended

Techniques it helps detect

Rules that depend on it

Splunk 1
Sigma 1
  • WMI Persistence by Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.