WMI Event Subscription abuse (MITRE ATT&CK T1546.003) is a Windows persistence and privilege escalation technique. Windows Management Instrumentation (WMI) can install event filters, providers, consumers and bindings that run code when a defined event occurs. Events that can be subscribed to include the wall clock time, user login and the computer's uptime.
How attackers use it
An adversary subscribes to an event and sets code to run when it happens. That gives persistence with no startup folder entry, no run key and no service.
MITRE adds two details. Adversaries may compile WMI scripts into Managed Object Format (MOF) files, with the .mof extension, using mofcomp.exe, and use them to create a malicious subscription. And WMI subscription execution is proxied by the WMI Provider Host process, WmiPrvSe.exe, so the code may run with SYSTEM privileges.
A permanent subscription has three parts that work together:
- An event filter, which describes what event to wait for.
- An event consumer, which describes what to do.
- A binding, which links a filter to a consumer.
All three need to exist, so finding one without its partners is rarely the full picture.
How to detect it
MITRE's strategy covers creation and execution:
- Creation of
EventFilter,EventConsumerandFilterToConsumerBindingobjects, whether through WMI itself or through MOF file execution. - Command line use of
mofcomp.exe. - Use of
Register-WmiEventin PowerShell. - Anomalous child processes of
WmiPrvSe.exe, which show a triggered execution. - Odd process lineage and entries in WMI logging channels.
Sysmon helps directly. Its event IDs 19, 20 and 21 record WMI event filter, consumer and binding activity. The operational log under Microsoft-Windows-WMI-Activity is another source.
How to reduce the risk
MITRE lists three mitigations:
- Restrict remote WMI. By default only administrators can connect remotely using WMI. Restrict which other users can connect, or disallow all remote WMI connections.
- Avoid credential overlap. Keep administrator and privileged account credentials separate across systems, so one compromised host does not open others.
- Enable ASR rules. On Windows 10, Attack Surface Reduction rules can prevent malware from abusing WMI to gain persistence.
Check your own environment
In PowerShell, read-only:
Get-CimInstance -Namespace root\subscription -ClassName __EventFilter
Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding
On most clean systems, these return little or nothing, apart from a few entries that come with Windows or well known management tools. For each result, record who owns it and what the consumer runs. If you see a CommandLineEventConsumer or ActiveScriptEventConsumer you cannot explain, escalate.
A short checklist:
- Are Sysmon WMI events 19, 20 and 21 sent to your log platform?
- Do you know which management products legitimately register subscriptions?
- Is remote WMI limited to the accounts and networks that need it?
- Is mofcomp.exe execution outside admin tooling alerting?
Quick check
Why does WMI persistence often run as SYSTEM?
Subscription execution is proxied by the WMI Provider Host process, WmiPrvSe.exe, which can run with SYSTEM privileges.
What three objects make up a permanent subscription?
An event filter, an event consumer and a binding that links them.
