LoFP / administrators and software may create authorized wmi subscriptions. review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro.

splunk

Techniques

Sample rules

WMI Permanent Event Subscription - Sysmon

source: splunk
technicques:

Description

Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.

Detection logic

`sysmon`
EventCode=21
Operation IN (
    Created,
    Deleted,
    Modified
)


| stats count min(_time) as firstTime
              max(_time) as lastTime
    BY dest user Consumer Filter


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `wmi_permanent_event_subscription___sysmon_filter`