Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1546.003

Windows Management Instrumentation Event Subscription

Privilege EscalationPersistence 19 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Windows MOF Event Triggered Execution via WMI production 2026-10-09
splunk WMI Permanent Event Subscription - Sysmon production 2026-10-09
splunk WMI Permanent Event Subscription production 2026-10-09
splunk Detect WMI Event Subscription Persistence deprecated 2026-10-05
elastic Mofcomp Activity production 2026-09-18
elastic Suspicious WMI Event Subscription Created production 2026-09-18
elastic Persistence via WMI Event Subscription production 2026-09-18
sigma NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE test 2026-06-19
sigma Potential Remote WMI ActiveScriptEventConsumers Activity test 2024-09-02
sigma WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load test 2023-02-22
sigma WMI Backdoor Exchange Transport Agent test 2023-02-08
sigma Powershell WMI Persistence test 2022-12-25
sigma WMI Persistence - Security test 2022-11-29
sigma WMI Persistence - Script Event Consumer test 2022-10-11
sigma Suspicious Encoded Scripts in a WMI Consumer test 2022-10-09
sigma WMI Persistence test 2022-02-10
sigma WMI Event Subscription test 2021-11-27
sigma WMI Persistence - Command Line Event Consumer test 2021-11-27
sigma WMI Persistence - Script Event Consumer File Write test 2021-11-27