T1546.003 — Windows Management Instrumentation Event Subscription

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

title: "T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription"
id: 5df1f680-6992-4cb8-b6b8-5d3a14689d21
description: 'Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, ProcessNameAllowlist, ParentProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1546/003
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_wmic_subscription:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'eventfilter'
      - 'eventconsumer'
      - 'filtertoconsumerbinding'
  selection_mofcomp:
    Image|endswith: '\mofcomp.exe'
  selection_powershell_wmi_persist:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Register-WmiEvent'
      - 'Set-WmiInstance'
      - '__EventFilter'
      - 'CommandLineEventConsumer'
  selection_wmiprvse_child:
    ParentImage|endswith: '\WmiPrvSE.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate WMI-based monitoring or management tools.

level: medium

Related sub-techniques

Explore