Detecting WMI Persistence
FreeIdentify and analyze WMI-based persistence mechanisms.
Free · Opens the source repo
What Detecting WMI Persistence does
Detecting WMI Persistence is a specialized skill designed for cybersecurity professionals focused on threat hunting and incident response. This skill leverages Sysmon's event logging capabilities to monitor Windows Management Instrumentation (WMI) for signs of malicious persistence techniques, specifically those outlined in MITRE ATT&CK under T1546.003. By analyzing Sysmon Event IDs 19, 20, and 21, users can detect the creation of EventFilters, EventConsumers, and their bindings, which are often utilized by attackers to maintain access to compromised systems.
The workflow begins with the collection of telemetry data from Sysmon, where it parses relevant event IDs to identify suspicious WMI activity. It flags potentially harmful consumers, such as CommandLineEventConsumer and ActiveScriptEventConsumer, that can execute commands or scripts when triggered. The skill also examines the WQL queries associated with EventFilters to uncover any malicious triggers that could indicate an ongoing attack or persistence mechanism.
For effective use, the skill requires a robust setup, including Sysmon v6.1+ with WMI event logging enabled, and a SIEM system capable of ingesting Sysmon data. The integration with tools like Sysinternals Autoruns and PowerShell for manual enumeration allows for a thorough investigation of WMI subscriptions. This skill is particularly beneficial during incident response scenarios or purple team exercises, where validating WMI defenses against potential threats is critical.
In conclusion, Detecting WMI Persistence is essential for security analysts and incident responders who need to identify and remediate WMI-based persistence mechanisms. By providing a structured approach to analyze Sysmon events, this skill enhances the ability to respond to and mitigate threats effectively.
When to use it
Use this skill when investigating suspicious WMI activity or during incident response to detect persistence techniques.
When not to use it
This skill is not suitable for environments without Sysmon deployed or where WMI event logging is not enabled.
What you can build with it
Incident Response Investigation
Utilize the skill during an incident response to identify and remediate WMI-based persistence mechanisms after detecting suspicious activity.
Threat Hunting
Employ the skill to hunt for WMI event subscription persistence in endpoint telemetry, especially when Sysmon alerts are triggered.
Purple Team Exercises
Use this skill in purple team exercises to validate WMI defenses against potential persistence techniques.
How to install Detecting WMI Persistence
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-wmi-persistence --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting WMI Persistence
When to Use
- When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
- After detecting suspicious WMI activity in endpoint telemetry
- During incident response to identify attacker persistence mechanisms
- When Sysmon alerts trigger on Event IDs 19, 20, or 21
- During purple team exercises testing WMI-based persistence
Prerequisites
- Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
- Windows Security Event Log forwarding configured
- SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
- PowerShell access for WMI enumeration on endpoints
- Sysinternals Autoruns for manual WMI subscription review
Workflow
- Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
- Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
- Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
- Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
- Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
- Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
- Document and Remediate: Remove malicious subscriptions and update detection rules.
Key Concepts
| Concept | Description |
|---|---|
| Sysmon Event 19 | WmiEventFilter creation detected |
| Sysmon Event 20 | WmiEventConsumer creation detected |
| Sysmon Event 21 | WmiEventConsumerToFilter binding detected |
| T1546.003 | Event Triggered Execution: WMI Event Subscription |
| CommandLineEventConsumer | Executes system commands when filter triggers |
| ActiveScriptEventConsumer | Runs VBScript/JScript when filter triggers |
Tools & Systems
| Tool | Purpose |
|---|---|
| Sysmon | Windows event monitoring for WMI activity |
| WMI Explorer | GUI tool for browsing WMI namespaces |
| Autoruns | Sysinternals tool listing persistence mechanisms |
| PowerShell Get-WMIObject | Enumerate WMI event subscriptions |
| Splunk | SIEM analysis of Sysmon WMI events |
| Velociraptor | Endpoint WMI artifact collection |
Output Format
Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]
Frequently asked questions about Detecting WMI Persistence
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.