WMI Event Subscription Persistence - CommandLine or ActiveScript Consumer

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.