SysmonPolicy Change

Event 19: WMI Event Filter Activity Detected

Logs the registration of WMI event filters, which is a method used by malware to execute.

Technical Details

Sysmon Source

Event ID: 19

Sysmon- Policy Change

Event Description

Logs the registration of WMI event filters, which is a method used by malware to execute.

Key Log Fields

  • UtcTime - UTC timestamp of WMI filter activity
  • EventType - Type of WMI event (WmiEventFilter)
  • Operation - Operation performed (Created/Deleted)
  • User - Account performing the operation
  • EventNamespace - WMI namespace
  • Name - Name of the WMI filter
  • Query - WQL query associated with the filter

MITRE ATT&CK® Mapping (1)

T1546.003persistence, privilege-escalation
Windows Management Instrumentation Event Subscription

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015) Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts – using `mofcomp.exe` –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018) WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Contents