These rules cover COM registration and activation, WMI subscriptions, and related commands and processes.
The WMI Activity event summaries use registered provider messages from the Windows Server 2022 export and Windows 11 export. The messages describe event fields on those builds. They do not identify event 5860 as a temporary consumer record or show that an event occurred.
- Sysmon Event ID 19: WmiEventFilter activity
- Sysmon Event ID 20: WmiEventConsumer activity
- Sysmon Event ID 21: WmiEventConsumerToFilter activity
- Security Event ID 4662: An operation was performed on an object
- WMI-Activity Event ID 5859: WMI notification query activation context
- WMI-Activity Event ID 5860: WMI notification query and client context
- WMI-Activity Event ID 5861: Permanent event consumer binding activity
COM Registry Records #
Rules select COM registration keys or shell DelegateExecute values in the Windows registry.
No rules currently have sufficient source evidence for selection in this section.
COM Registry Command Context #
Rules select reg.exe commands containing InprocServer32.
No rules currently have sufficient source evidence for selection in this section.
COM Activation and Process Context #
Rules select COM commands and incoming connections.
No rules currently have sufficient source evidence for selection in this section.
WMI Subscription Records #
Rules select WMI event filters, consumers, and bindings.
No rules currently have sufficient source evidence for selection in this section.
WMI Namespace Access #
Security object audits select access to a WMI namespace. Access alone does not establish a subscription.
- WMI Persistence - Security Sigma
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
WMI Notification Query and Client Context #
Rules select WMI notification query and client fields. Event 5860 alone does not identify the consumer type.
No rules currently have sufficient source evidence for selection in this section.
WMI Commands and Method Requests #
Rules select subscription setup, process creation requests, and remote WMI commands.
No rules currently have sufficient source evidence for selection in this section.
WMI Process and Module Context #
Rules select WMI related process starts and module loads.
- Certutil payload obfuscation - Tchopper (command) Sigma
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload using the Tchopper tool.
- HackTool - Potential Impacket Lateral Movement Activity Sigma
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
- Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell Sigma
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
- Suspicious Autorun Registry Modified via WMI Sigma
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
- Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
- WMI spwaning PowerShell process - WMImplant Sigma
Detects scenarios where an attacker WMIimplant
WMI Correlated Activity #
Rules join WMI related events through an explicit relationship.
No rules currently have sufficient source evidence for selection in this section.
Mixed COM and WMI Context #
Rules can match several related Windows contexts, including COM or WMI activity.
No rules currently have sufficient source evidence for selection in this section.
References #
- [1] Microsoft Learn: Component Object Model (COM)
- [2] Microsoft Learn: InprocServer32
- [3] Microsoft Learn: TreatAs
- [4] Microsoft Learn: Merged View of HKEY_CLASSES_ROOT
- [5] Microsoft Learn: Registry Keys Affected by WOW64
- [6] Microsoft Learn: Receiving Events at All Times
- [7] Microsoft Learn: Sysmon event descriptions
- [8] Microsoft Learn: Security event 4662
- [9] Microsoft Learn: Receiving Events for the Duration of Your Application
- [10] Microsoft Learn: __EventConsumer class
- [11] Microsoft Learn: ActiveScriptEventConsumer class
- [12] Microsoft Learn: CommandLineEventConsumer class
- [13] Microsoft Learn: Create method of Win32_Process
- [14] Microsoft Learn: Provider Hosting and Security
- [15] Microsoft Learn: Connecting to WMI on a Remote Computer