WMI Event Subscription Persistence — T1546.003

Ankit Mehta@Secvyn

•updated Jun 27, 2026•2•0•4

This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.