Threat Hunting Exercise: Analyzing Windows WMI Event Subscription Persistence Dataset
This hunt uses a simulated Windows Sysmon/WMI-Activity dataset (windows_wmi_persist_2022-06-18T101500.json) capturing T1546.003: Windows Management Instrumentation Event Subscription, where an adversary installs a permanent WMI event filter, consumer, and binding so that a malicious script executes automatically on a recurring trigger (e.g., every system startup or every 60 seconds), without any file on disk in a traditional autorun location.
Step 1: Hypothesis Formation
Hypothesis: A __EventFilter, __EventConsumer (typically CommandLineEventConsumer or ActiveScriptEventConsumer), and __FilterToConsumerBinding are created in the WMI repository, where the consumer executes an encoded PowerShell command or script, and the filter query is a recurring timer or logon-triggered condition. Indicators:
- Microsoft-Windows-WMI-Activity/Operational Event 5861 (permanent event consumer registered) or Sysmon Event 19/20/21 (WmiEvent).
- Consumer
CommandLineTemplatecontains encoded PowerShell (-enc) or a reference to an external script/payload. - Filter query (
WQL) matches a recurring interval (e.g.,WITHIN 60onWin32_LocalTime) rather than a one-time administrative condition. - No corresponding change-management ticket for WMI-based automation on the host.
Null Hypothesis: Legitimate systems-management software (e.g., SCCM, monitoring agents) uses WMI permanent event subscriptions for its own automation. Invalidate by checking the consumer's process/command against known vendor tooling and confirming via software inventory.
Rationale: WMI persistence is fileless and survives most traditional autorun-location sweeps (Run keys, Startup folder, services), making it a favorite of sophisticated actors; this hunt validates detection via the dedicated WMI-Activity operational log and Sysmon's WmiEvent channel.
Step 2: Data Sources and Scope
- Sources: Microsoft-Windows-WMI-Activity/Operational log (Event 5861); Sysmon (Event 19 WmiEventFilter, 20 WmiEventConsumer, 21 WmiEventConsumerToFilter); PowerShell script block logging (Event 4104) for the consumer payload.
- Scope: ~2022-06-18T10:15:00-10:20:00 UTC; Host: SRV-APP-05 (10.120.3.7); Actor: local Administrator context (post-exploitation).
- SIEM Queries (Splunk/ELK):
- Consumer registration:
index=sysmon EventID=20 | table _time, Consumer, Type, Destination - Encoded payload detection:
index=sysmon EventID=20 Destination="powershell -enc*" - Recurring filter query:
index=sysmon EventID=19 Query="WITHINWin32_LocalTime*"
Step 3: Key Findings
Parsed events (6 shown) confirm a WMI permanent event subscription firing a base64-encoded PowerShell payload every 60 seconds.
| Timestamp (UTC) | Host | Event | Details | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-06-18 10:15:02 | SRV-APP-05 | Sysmon 19 (WmiEventFilter) | Name=SysMonitorFilter; Query=SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' | Recurring-trigger IOC: 60-second polling interval - no legitimate one-time admin task uses this pattern; matches known WMI persistence templates. |
| 2022-06-18 10:15:03 | SRV-APP-05 | Sysmon 20 (WmiEventConsumer) | Name=SysMonitorConsumer; Type=CommandLineEventConsumer; Destination=powershell.exe -nop -w hidden -enc SQBFAFgA... | Payload IOC: base64-encoded PowerShell in the consumer command line - a hallmark of fileless WMI-based malware (e.g., historically associated with tools like POWERSTATS/MuddyWater). |
| 2022-06-18 10:15:03 | SRV-APP-05 | Sysmon 21 (Filter-to-Consumer Binding) | Binds SysMonitorFilter to SysMonitorConsumer | Completes the persistence chain - filter fires, consumer executes. |
| 2022-06-18 10:16:05 | SRV-APP-05 | Sysmon 1 (Process Create) | WmiPrvSE.exe spawns powershell.exe with the same encoded command | Execution IOC: first actual firing of the persistence mechanism, confirming it is live and functional, 62 seconds after binding. |
| 2022-06-18 10:17:07 | SRV-APP-05 | Sysmon 1 (Process Create) | Same spawn repeats | Second firing, ~60 seconds later - confirms the recurring interval is operating as designed. |
| - | SRV-APP-05 | (software inventory) | No SCCM, monitoring agent, or documented automation tool matches this consumer name or command pattern. | Legitimacy check IOC: naming (SysMonitor*) mimics legitimate-sounding tooling but has no match in the approved software inventory. |
Validation:
- Timeline: Filter → consumer → binding creation within one second, followed by execution firing on the expected 60-second interval - a complete and functioning fileless persistence mechanism.
- False Positives: Software inventory cross-check rules out known legitimate WMI-based tooling; the base64-encoded PowerShell payload has no benign administrative equivalent.
- Correlation: All three WMI objects and subsequent executions tie to the same host and time window - a single, isolated persistence installation.
Step 4: Recommendations & Next Steps
- Immediate Response: Remove the malicious
__EventFilter,__EventConsumer, and binding viawmic/PowerShellRemove-WmiObject; decode and analyze the base64 payload to determine the second-stage functionality; isolate SRV-APP-05 for further forensic review; check for additional persistence mechanisms installed alongside this one. - Detection: Sigma-style rule:
title: WMI Permanent Event Subscription with Encoded PowerShell Consumer→selection: EventID=20 AND Destination contains 'powershell' AND Destination contains '-enc'- enable and forward the WMI-Activity/Operational log by default, as it is disabled in many environments. - Pro Tip: Baseline the (usually very small) set of legitimate permanent WMI subscriptions in your environment using
Get-WmiObject -Namespace root\subscription -Class __EventFilteracross the fleet - any subscription not on that baseline list is a near-immediate investigative priority, since legitimate use of this mechanism is rare outside specific management tools.
Hypothesis confirmed - a fileless WMI permanent event subscription was installed to execute an encoded PowerShell payload every 60 seconds!