Detection rules › By event

Microsoft-Windows-WMI-Activity

Event	Rules
Event ID 5858	1
Event ID 5859	1
Event ID 5860	1
Event ID 5861	2

Event ID 5858

1 detection rules reference this event. View event page.

Sigma (1)

Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog severity medium T1685, T1685.005

Event ID 5859

1 detection rules reference this event. View event page.

Sigma (1)

WMI Persistence severity medium T1546, T1546.003

Event ID 5860

1 detection rules reference this event. View event page.

Splunk (1)

WMI Temporary Event Subscription severity medium T1047

Event ID 5861

2 detection rules reference this event. View event page.

Sigma (1)

WMI Persistence severity medium T1546, T1546.003

Splunk (1)

WMI Permanent Event Subscription severity medium T1047