Applied Cybernetics Group
T1546.003 Windows Management Instrumentation Event Subscription
- Technique
T1546.003- Tactics
- Privilege Escalation, Persistence
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 12
- Elastic, Splunk
- 6
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1546/003
MITRE description
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015) Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts – using `mofcomp.exe` –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018) WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Potential Remote WMI ActiveScriptEventConsumers Activity (threat-hunting)
- WMI Persistence - Security (core)
- WMI Persistence (core)
- WMI Persistence - Script Event Consumer File Write (core)
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load (core)
- WMI Persistence - Command Line Event Consumer (core)
- Powershell WMI Persistence (core)
- WMI Backdoor Exchange Transport Agent (core)
- WMI Persistence - Script Event Consumer (core)
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE (core)
- WMI Event Subscription (core)
- Suspicious Encoded Scripts in a WMI Consumer (core)
Elastic and Splunk rules
- Mofcomp Activity (elastic)
- Suspicious WMI Event Subscription Created (elastic)
- Persistence via WMI Event Subscription (elastic)
- Windows MOF Event Triggered Execution via WMI (splunk)
- WMI Permanent Event Subscription (splunk)
- WMI Permanent Event Subscription - Sysmon (splunk)