T1546.003PersistencePrivilege Escalation
Windows Management Instrumentation Event Subscription
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
12 Sigma rules tagged T1546.003Windows Management Instrumentation Event SubscriptionT1546.00312 general rules
- WMI Backdoor Exchange Transport Agentcriticaltest
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXEhightest
- Suspicious Encoded Scripts in a WMI Consumerhightest
- WMI Persistence - Command Line Event Consumerhightest
- WMI Persistence - Script Event Consumer File Writehightest
- Potential Remote WMI ActiveScriptEventConsumers Activitymediumtest
- Powershell WMI Persistencemediumtest
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Loadmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Windows Management Instrumentation Event Subscription
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.