WMI Event Subscription Persistence via EventID 5861 (T1546.003)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.