How to Detect WMI Persistence and Lateral Movement

Creating a WMI subscription (attacker technique):

# Create a filter: trigger every 60 seconds
$Filter = Set-WmiInstance -Namespace 'root\subscription' \
  -Class '__EventFilter' -Arguments @{
    Name = 'SysmonUpdate'
    EventNameSpace = 'root\cimv2'
    QueryLanguage = 'WQL'
    Query = 'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE
             TargetInstance ISA "Win32_LocalTime" AND
             TargetInstance.Seconds = 0'
  }
# This filter fires every minute when seconds = 0

# Create a consumer: execute a PowerShell command
$Consumer = Set-WmiInstance -Namespace 'root\subscription' \
  -Class 'CommandLineEventConsumer' -Arguments @{
    Name = 'SysmonUpdate'
    CommandLineTemplate = 'powershell.exe -NoP -NonI -W Hidden -enc [base64_payload]'
  }

# Create the binding: link filter to consumer
Set-WmiInstance -Namespace 'root\subscription' \
  -Class '__FilterToConsumerBinding' -Arguments @{
    Filter = $Filter
    Consumer = $Consumer
  }
# Persistence is now established: survives reboots, runs as SYSTEM
# Does not appear in Task Scheduler, Services, or registry Run keys

WMI for lateral movement:

# Execute a command on a remote machine via WMI (requires admin credentials)
Invoke-WmiMethod -ComputerName 192.168.1.100 \
  -Class Win32_Process \
  -Name Create \
  -ArgumentList "cmd.exe /c whoami > C:\temp\out.txt"
  # -Credential domain\admin  (if needed)

# wmic.exe equivalent:
wmic /node:192.168.1.100 /user:CORP\admin process call create "cmd.exe /c whoami"

# These do not require opening port 3389 (RDP) or 445 (SMB for PSExec)
# They use DCOM (port 135 + dynamic ports) and WMI service
# Blend with legitimate admin activity on many Windows networks

Enable WMI Activity logging (required for Events 5857-5861):

# Enable WMI logging via Group Policy:
# Computer Configuration > Administrative Templates > Windows Components >
# Windows Management Instrumentation (WMI) > WMI Logging Level
# Setting: Verbose (level 2)

# Or enable via wevtutil:
wevtutil sl Microsoft-Windows-WMI-Activity/Operational /e:true

# Verify:
Get-WinEvent -LogName 'Microsoft-Windows-WMI-Activity/Operational' -MaxEvents 1

Key WMI Event IDs:

Sentinel KQL: detect new WMI subscriptions:

// Alert: new permanent WMI event subscription created
Event
| where Source == "Microsoft-Windows-WMI-Activity"
| where EventID in (5859, 5861)
| where TimeGenerated > ago(24h)
// Parse the subscription details from the message:
| extend
    NamespaceName = extract(@'Namespace = ([^;]+)', 1, RenderedDescription),
    Consumer = extract(@'Consumer = ([^;]+)', 1, RenderedDescription),
    Filter = extract(@'Filter = ([^;]+)', 1, RenderedDescription)
// Exclude known-good subscriptions (AV, management tools):
| where Consumer !contains "SCM Event Log Consumer"
    and Consumer !contains "NTEventLogEventConsumer"
    and Consumer !contains "BVTConsumer"
| project TimeGenerated, Computer, EventID, NamespaceName, Consumer, Filter

Sysmon Events 19-21 for WMI subscription detection:

<!-- Enable in Sysmon config for WMI subscription monitoring -->
<EventFiltering>
  <WmiEvent onmatch="include">
    <!-- Catch all WMI subscriptions except known-good ones -->
    <Operation condition="is not">SCM Event Log Consumer</Operation>
  </WmiEvent>
</EventFiltering>

// Sysmon WMI events in Sentinel:
Event
| where Source == "Microsoft-Windows-Sysmon"
| where EventID in (19, 20, 21)
| extend EventData = parse_xml(EventData)
| extend
    EventType = tostring(EventData.DataItem.EventData.Data[3]["#text"]),
    Name = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    Query = tostring(EventData.DataItem.EventData.Data[5]["#text"])
| where EventID == 21  // Binding created: final step of subscription setup
| project TimeGenerated, Computer, EventType, Name, Query

Sysmon Event 1: wmic.exe with remote node:

// Detect wmic.exe executing commands on remote hosts
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 1
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    CommandLine = tostring(EventData.DataItem.EventData.Data[10]["#text"]),
    User = tostring(EventData.DataItem.EventData.Data[12]["#text"])
| where Image has "wmic.exe"
    and CommandLine has_any ("/node:", "process call create", "Win32_Process")
// Exclude known management tools by username or originating host
| project TimeGenerated, Computer, User, CommandLine

// Also detect PowerShell WMI lateral movement:
| where Image has "powershell"
    and CommandLine has_any ("Invoke-WmiMethod", "Invoke-CimMethod", "Win32_Process")
    and CommandLine has "-ComputerName"
| project TimeGenerated, Computer, User, CommandLine

Network detection: DCOM connections (WMI uses DCOM port 135):

// Detect unusual processes making DCOM connections (lateral movement via WMI)
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 3
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    DestPort = tostring(EventData.DataItem.EventData.Data[16]["#text"]),
    DestIP = tostring(EventData.DataItem.EventData.Data[14]["#text"])
| where DestPort == "135"  // DCOM endpoint mapper
    and Image !has_any ("mmc", "wmiprvse", "svchost", "taskhostw")
| project TimeGenerated, Computer, Image, DestIP, DestPort

Audit all existing WMI subscriptions (run during IR):

# List all permanent event filters:
Get-WMIObject -Namespace "root\subscription" -Class __EventFilter |
  Select-Object Name, Query, @{N='Created';E={$_.ConvertToDateTime($_.CreationDate)}}

# List all event consumers:
Get-WMIObject -Namespace "root\subscription" -Class __EventConsumer |
  Select-Object __CLASS, Name,
    @{N='Command';E={if ($_.CommandLineTemplate) {$_.CommandLineTemplate} else {$_.ScriptText}}}

# List all bindings (filter + consumer associations):
Get-WMIObject -Namespace "root\subscription" -Class __FilterToConsumerBinding |
  Select-Object Filter, Consumer

# Quick one-liner to show all subscriptions with their commands:
Get-WMIObject -Namespace "root\subscription" -Class __EventConsumer |
  ForEach-Object {
    Write-Host "Name: $($_.Name)" -ForegroundColor Yellow
    Write-Host "Class: $($_.__CLASS)"
    if ($_.CommandLineTemplate) { Write-Host "Command: $($_.CommandLineTemplate)" }
    if ($_.ScriptText) { Write-Host "Script: $($_.ScriptText)" }
    Write-Host "---"
  }

Remove a malicious WMI subscription:

# Remove by name: replace 'SysmonUpdate' with the actual subscription name:
Get-WMIObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" |
  Where-Object { $_.Filter -like "*SysmonUpdate*" } | Remove-WmiObject

Get-WMIObject -Namespace "root\subscription" -Class "__EventFilter" |
  Where-Object { $_.Name -eq "SysmonUpdate" } | Remove-WmiObject

Get-WMIObject -Namespace "root\subscription" -Class "CommandLineEventConsumer" |
  Where-Object { $_.Name -eq "SysmonUpdate" } | Remove-WmiObject

# Remove in order: binding first, then filter and consumer
# (Removing the binding prevents the subscription from firing during cleanup)

Block WMI lateral movement with firewall rules:

# Block inbound DCOM/WMI to workstations (they should not receive WMI management connections)
New-NetFirewallRule -DisplayName "Block Inbound WMI/DCOM" \
  -Direction Inbound -Protocol TCP -LocalPort 135 \
  -RemoteAddress @("10.0.0.0/8")  # Adjust to your network
  -Action Block -Profile Domain
# Note: This may impact legitimate admin tools: test in audit mode first