WMI Event Subscription Persistence.

Persistence technique that registers a permanent WMI event filter and consumer so attacker code runs whenever a chosen system event occurs. It belongs to the Attacks & Threats category of cybersecurity.

Persistence technique that registers a permanent WMI event filter and consumer so attacker code runs whenever a chosen system event occurs.

WMI event subscription persistence (MITRE ATT&CK T1546.003) abuses Windows Management Instrumentation by creating an __EventFilter (a WQL query selecting a trigger condition), an __EventConsumer (the action, often CommandLineEventConsumer or ActiveScriptEventConsumer), and a __FilterToConsumerBinding linking them. Once written to the root\subscription namespace, the WMI service executes the consumer in the SYSTEM context whenever the filter fires - at logon, on a timer, when a process starts, when a USB is inserted, etc. The technique is fileless, survives reboots, and is widely used by advanced threat actors. Detection: enable WMI-Activity Operational and Trace logs, monitor Sysmon events 19/20/21, baseline subscriptions, and remove unfamiliar bindings. Hardening: restrict WMI namespace permissions and apply ASR rules.

Defences for WMI Event Subscription Persistence typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: WMI permanent subscription, Permanent event subscription.