From asi
Detects WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, 21 for malicious EventFilters, Consumers, and Bindings. For threat hunting and incident response on Windows.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
Detects WMI event subscription persistence (T1546.003) by analyzing Sysmon Event IDs 19, 20, 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding in threat hunts.
Detects WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon events ID 19, 20, 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creations. For threat hunting and incident response.
Hunts for adversary persistence via WMI event subscriptions in Windows by monitoring Sysmon events 19/20/21, consumer types, and bindings. Ideal for threat hunting and incident response on endpoints.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| Sysmon Event 19 | WmiEventFilter creation detected |
| Sysmon Event 20 | WmiEventConsumer creation detected |
| Sysmon Event 21 | WmiEventConsumerToFilter binding detected |
| T1546.003 | Event Triggered Execution: WMI Event Subscription |
| CommandLineEventConsumer | Executes system commands when filter triggers |
| ActiveScriptEventConsumer | Runs VBScript/JScript when filter triggers |
| Tool | Purpose |
|---|---|
| Sysmon | Windows event monitoring for WMI activity |
| WMI Explorer | GUI tool for browsing WMI namespaces |
| Autoruns | Sysinternals tool listing persistence mechanisms |
| PowerShell Get-WMIObject | Enumerate WMI event subscriptions |
| Splunk | SIEM analysis of Sysmon WMI events |
| Velociraptor | Endpoint WMI artifact collection |
Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]