title: WMI Event Subscription Created
id: f4ea9f7d-cd07-4968-b0f2-2b1327bbdf08
status: experimental
description: |
  Detects the three Sysmon events written when a permanent WMI event subscription is registered:
  the filter (19), the consumer (20) and the binding that joins them (21). Subscriptions survive
  reboots, run as SYSTEM and leave nothing in the Run keys, services or scheduled tasks, which
  is why they are missed by anybody checking only those.
references:
  - https://attack.mitre.org/techniques/T1546/003/
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  product: windows
  category: wmi_event
detection:
  selection:
    EventID:
      - 19
      - 20
      - 21
  filter_optional_default_binding:
    Consumer|contains: 'SCM Event Log Consumer'
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - The binding Windows ships with (SCM Event Log Filter to SCM Event Log Consumer), which the optional filter removes.
  - Management software that registers its own subscriptions at install time (SCCM, some OEM utilities and hardware monitoring agents). These are few and stable, so baseline them once by consumer name.
level: medium