domains / families / security / detecting-wmi-persistence

detecting-wmi-persistence

separate

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon

When to use

• When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
• After detecting suspicious WMI activity in endpoint telemetry
• During incident response to identify attacker persistence mechanisms
• When Sysmon alerts trigger on Event IDs 19, 20, or 21
• During purple team exercises testing WMI-based persistence

Skill page

Source