WMI event subscription objects named on a command line

Siemphony@siemphonymediumT1546.003unverified

Matches the registration half of AN0236: a process whose command line names the WMI subscription classes, the subscription namespace, the PowerShell event-registration cmdlets, or the MOF compiler that turns a .mof file into those same objects. All terms sit on the single `CommandLine` field, so the rule renders the same way in every backend and does not depend on how a pipeline populates `Image`. The namespace is listed in both separator forms because WMI accepts `root/subscription` as readily as `root\subscription`, and a single-form gate is defeated by typing the other one. Note that `Register-WmiEvent` and `Register-CimIndicationEvent` register temporary, session-scoped subscriptions that die with the session: they are named in MITRE's analytic text and are kept here for that reason, but a match on either is not by itself evidence of the persistence this technique describes. The brief also offers the WMI-Activity channel (5857/5858/5860/5861), which is the more direct evidence — 5861 records the consumer binding itself — but that channel's fields are not standardised in Sigma's Windows taxonomy, and inventing field names there would produce a rule that parses and never matches, so it is not used here. Two limits: a subscription created entirely through the WMI API by compiled code, or one whose class names live only inside the .mof file rather than on the command line, leaves nothing for this rule except the mofcomp term; and the second half of the analytic — anomalous children of WmiPrvSE.exe within MITRE's `TimeWindow` knob — is a correlation Sigma cannot express. If your process_creation feed is Security 4688 rather than Sysmon EventID 1, note that 4688 needs *Audit Process Creation* and its `CommandLine` field needs the separate *Include command line in process creation events* policy; without the latter every selector here is blank and the rule silently returns nothing. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0086, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "__EventFilter" or ProcessCommandLine contains "__FilterToConsumerBinding" or ProcessCommandLine contains "EventConsumer" or ProcessCommandLine contains "Register-WmiEvent" or ProcessCommandLine contains "Register-CimIndicationEvent" or ProcessCommandLine contains "root\\subscription" or ProcessCommandLine contains "root/subscription" or ProcessCommandLine contains "mofcomp")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*__EventFilter*" OR CommandLine="*__FilterToConsumerBinding*" OR CommandLine="*EventConsumer*" OR CommandLine="*Register-WmiEvent*" OR CommandLine="*Register-CimIndicationEvent*" OR CommandLine="*root\\subscription*" OR CommandLine="*root/subscription*" OR CommandLine="*mofcomp*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*__eventfilter*" OR TO_LOWER(process.command_line) LIKE "*__filtertoconsumerbinding*" OR TO_LOWER(process.command_line) LIKE "*eventconsumer*" OR TO_LOWER(process.command_line) LIKE "*register-wmievent*" OR TO_LOWER(process.command_line) LIKE "*register-cimindicationevent*" OR TO_LOWER(process.command_line) LIKE "*root\\\\subscription*" OR TO_LOWER(process.command_line) LIKE "*root/subscription*" OR TO_LOWER(process.command_line) LIKE "*mofcomp*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(__EventFilter|__FilterToConsumerBinding|EventConsumer|Register-WmiEvent|Register-CimIndicationEvent|root\\subscription|root/subscription|mofcomp)</field>    <description>WMI event subscription objects named on a command line</description>    <mitre>      <id>T1546.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f566af8e-af06-4ec0-8d37-bc58a7ab16c1

ATT&CKT1546.003

T1546.003Windows Management Instrumentation Event Subscription

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0236 asks for creation of WMI EventFilter, EventConsumer and FilterToConsumerBinding objects, through WMI or MOF compilation, plus anomalous children of WmiPrvSE.exe. This rule implements the registration half, and only where that registration is visible on a command line: a process creation whose CommandLine names one of the subscription classes, the subscription namespace, the PowerShell event-registration cmdlets, or the MOF compiler.

02 · Telemetry you need

category: process_creation / product: windows, from AN0236's Sysmon EventID 1 source. If your feed is Security 4688 instead, it needs Audit Process Creation, and its CommandLine field needs the separate Include command line in process creation events policy. Without the latter every selector here is blank and the rule silently returns nothing.
Say this to a learner plainly: the authoritative observable for this technique is Sysmon EventID 19/20/21 (wmi_event), which records filter, consumer and binding creation directly and cannot be dodged by command-line obfuscation. It is absent from this brief, so it cannot be authored against under the logsource-verbatim rule — but a deployment should pair this rule with it, not rely on this one.

03 · How the logic works

One selection, one field, eight contains terms ORed together. Three name the objects: __EventFilter, __FilterToConsumerBinding, and the bare EventConsumer, which catches CommandLineEventConsumer and ActiveScriptEventConsumer without enumerating each. Two are the namespace, root\subscription and root/subscription — both forms, because WMI accepts a forward slash as readily as a backslash and a single-form gate is defeated by typing the other separator. Two are the cmdlets Register-WmiEvent and Register-CimIndicationEvent. One is mofcomp. Everything sits on CommandLine, so the rule renders identically in every backend and does not depend on how a pipeline populates Image. Two weaknesses are baked into that shape. The cmdlet pair registers temporary, session-scoped subscriptions that die with the console — a match on either is not by itself the persistence this technique describes, though both are in MITRE's analytic text, which is why they are kept. And the realistic delivery paths leave nothing on the command line at all: powershell.exe -enc <base64> keeps the class names inside the payload, a .ps1 puts only a script path there, and a compiled dropper using the WMI API names nothing. For the majority of real cases mofcomp is the only term still standing.

04 · Common false positives

mofcomp is also the loudest term. Management agents and vendor packages compile MOF files during installation, client repair and hardware-inventory extension; on an estate with a configuration-management client that arrives as a fleet-wide burst at image build and after every agent update. A bare mofcomp contains-term also matches any command line that merely mentions the path.
Behind it: monitoring, backup and power-management products whose designed mechanism is a permanent consumer, so their own setup scripts contain __EventFilter verbatim; read-only hygiene scripts enumerating root\subscription; and administrators using the two cmdlets interactively while troubleshooting.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. Derived from a MITRE scaffold that contains no query logic, never executed against a log line; reasoning on paper that `mofcomp evil.mof` lands in the selection is analysis, not verification.
tier_2: run read-only, rank by term and by parent process, and turn the recurring management-agent MOF compilations into the allowlist.
tier_3: ** move the primary detection onto wmi_event and keep this command-line rule as supporting context.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: medium sits uneasily on top of a first false positive described as the
MITRE's ProcessNameAllowlist knob is where the benign permanent consumers go,
MITRE's other three knobs — TimeWindow, UserContext and
Add the wmi_event companion. It is the only way to see the encoded-command,

Declared by the author

Management agents and vendor packages compiling MOF files with mofcomp.exe during installation, client repair and hardware-inventory extension, which is a supported and routine operation — on an estate with a configuration-management client this is the loudest term in the rule and it arrives as a fleet-wide burst at image build time and after every agent update.
Monitoring, backup and power-management products that register permanent event consumers as their designed mechanism, so their own setup scripts contain __EventFilter and CommandLineEventConsumer verbatim. This is MITRE's ProcessNameAllowlist knob, populated locally with whichever products your estate actually runs.
Hygiene and audit scripts that enumerate rather than create, for example a scheduled Get-WmiObject -Namespace root\subscription -Class __EventFilter inventory run by the security team — read-only, and it matches on the namespace and class name exactly like a creation would.
Administrators using Register-WmiEvent or Register-CimIndicationEvent interactively while troubleshooting, which registers only a temporary session-scoped subscription that disappears when the console closes.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — WMI permanent event subscription installed
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/f566af8e-af06-4ec0-8d37-bc58a7ab16c1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

WMI event subscription objects named on a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it