wmi.json

{
  "dataset": {
    "name": "EID Quick Reference - WMI Activity",
    "version": "1.7.0",
    "generatedAt": "2026-04-12T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/wmi.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 5857,
      "log": "WMI",
      "provider": "Microsoft-Windows-WMI-Activity",
      "channel": "Microsoft-Windows-WMI-Activity/Operational",
      "level": "Information",
      "title": "WMI provider host started",
      "summary": "WMI provider DLL loaded into a provider host process.",
      "details": "Generated when a WMI provider host (WmiPrvSE.exe) successfully loads a provider. Most legitimate WMI providers load from System32 or known application directories. A provider loading from a temp directory, user profile, or uncommon location is a strong indicator of a malicious WMI provider registered for persistence or lateral movement.",
      "category": "WMI Provider",
      "tags": [
        "wmi",
        "provider",
        "persistence",
        "lateral-movement"
      ],
      "relatedEventIds": [
        {
          "id": 5861,
          "log": "WMI"
        },
        {
          "id": 1,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1047",
          "techniqueName": "Windows Management Instrumentation",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Check ProviderPath for DLLs outside of System32 or known application directories",
          "Correlate HostProcess PID with process creation logs (Security EID 4688) to identify the parent",
          "Cross-reference ProviderName with known legitimate WMI providers"
        ],
        "commonFalsePositives": [
          "Legitimate third-party software registering WMI providers",
          "Management and monitoring agents (e.g., SCCM, antivirus)"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "ProviderName",
          "xpath": "EventData/Data[@Name='ProviderName']",
          "description": "Name of the WMI provider loaded"
        },
        {
          "name": "ProviderPath",
          "xpath": "EventData/Data[@Name='ProviderPath']",
          "description": "Full DLL path of the provider; paths outside System32 are anomalous"
        },
        {
          "name": "HostProcess",
          "xpath": "EventData/Data[@Name='HostProcess']",
          "description": "PID of the WmiPrvSE.exe host process"
        }
      ],
      "lastReviewed": "2026-04-10"
    },
    {
      "id": 5858,
      "log": "WMI",
      "provider": "Microsoft-Windows-WMI-Activity",
      "channel": "Microsoft-Windows-WMI-Activity/Operational",
      "level": "Error",
      "title": "WMI operation failed",
      "summary": "A WMI provider or client operation returned an error.",
      "details": "Generated when a WMI operation fails, including provider load errors, query execution failures, and access denied results. Isolated errors are common in legitimate management software, but clusters of errors from a single process — especially access denied results on sensitive WMI classes (Win32_Process, Win32_NetworkAdapter, Win32_ShadowCopy) — may indicate failed WMI-based enumeration or exploitation.",
      "category": "WMI Error",
      "tags": [
        "wmi",
        "error",
        "reconnaissance"
      ],
      "relatedEventIds": [
        {
          "id": 5857,
          "log": "WMI"
        },
        {
          "id": 5861,
          "log": "WMI"
        },
        {
          "id": 4688,
          "log": "Security"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1047",
          "techniqueName": "Windows Management Instrumentation",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        },
        {
          "techniqueId": "T1592",
          "techniqueName": "Gather Victim Host Information",
          "tactics": [
            {
              "tacticId": "TA0043",
              "tacticName": "Reconnaissance"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Clusters of errors from one process in a short timeframe may indicate automated WMI enumeration or a tool attempting WMI-based lateral movement",
          "Access denied errors on sensitive classes (Win32_Process, Win32_ShadowCopy) from unexpected processes warrant investigation",
          "Correlate ClientProcessId with Security EID 4688 to identify the parent process and command line"
        ],
        "commonFalsePositives": [
          "Management software querying WMI classes unavailable on certain OS versions",
          "Poorly written admin scripts with unhandled WMI errors"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "ClientMachine",
          "xpath": "EventData/Data[@Name='ClientMachine']",
          "description": "Machine that initiated the WMI operation"
        },
        {
          "name": "ClientProcessId",
          "xpath": "EventData/Data[@Name='ClientProcessId']",
          "description": "PID of the process that initiated the WMI operation"
        },
        {
          "name": "User",
          "xpath": "EventData/Data[@Name='User']",
          "description": "User account under which the WMI operation was attempted"
        },
        {
          "name": "ResultCode",
          "xpath": "EventData/Data[@Name='ResultCode']",
          "description": "HRESULT error code for the failed operation"
        }
      ],
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 5859,
      "log": "WMI",
      "provider": "Microsoft-Windows-WMI-Activity",
      "channel": "Microsoft-Windows-WMI-Activity/Operational",
      "level": "Information",
      "title": "WMI ESS subscription notification fired",
      "summary": "A WMI Event Subscription System (ESS) notification was triggered.",
      "details": "Generated when a WMI ESS (Eventing Sub-System) subscription fires — that is, when an event filter condition is met and a bound event consumer is invoked. This event confirms that a WMI subscription has actively triggered, as opposed to EID 5860 (temporary registration) and EID 5861 (permanent registration) which only record creation.",
      "category": "WMI Subscription",
      "tags": [
        "wmi",
        "subscription",
        "persistence",
        "lateral-movement",
        "execution"
      ],
      "relatedEventIds": [
        {
          "id": 5860,
          "log": "WMI"
        },
        {
          "id": 5861,
          "log": "WMI"
        },
        {
          "id": 20,
          "log": "Sysmon"
        },
        {
          "id": 21,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1047",
          "techniqueName": "Windows Management Instrumentation",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        },
        {
          "techniqueId": "T1546.003",
          "techniqueName": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
          "tactics": [
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Correlate with EID 5861 to find when the triggering subscription was registered",
          "Identify the consumer type — CommandLineEventConsumer or ActiveScriptEventConsumer executing unexpected binaries is a high-confidence indicator",
          "Correlate with Security EID 4688 to find any processes spawned as a result of the subscription firing"
        ],
        "commonFalsePositives": [
          "Legitimate monitoring or management software using WMI event subscriptions (e.g., SCCM, antivirus self-healing)"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity"
      },
      "detectionRules": [
        {
          "platform": "KQL",
          "title": "WMI Permanent Subscription Triggered",
          "rule": "Event\n| where Source == \"Microsoft-Windows-WMI-Activity\"\n| where EventID == 5859\n| project TimeGenerated, Computer, EventData\n| order by TimeGenerated desc",
          "notes": "Correlate with EID 5861 to find when the subscription was registered. A 5859 firing shortly after a suspicious 5861 confirms active execution of a malicious subscription."
        }
      ],
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "Query",
          "xpath": "EventData/Data[@Name='Query']",
          "description": "The WMI event filter query that triggered"
        },
        {
          "name": "Consumer",
          "xpath": "EventData/Data[@Name='Consumer']",
          "description": "The event consumer that was invoked"
        }
      ],
      "lastReviewed": "2026-04-10"
    },
    {
      "id": 5860,
      "log": "WMI",
      "provider": "Microsoft-Windows-WMI-Activity",
      "channel": "Microsoft-Windows-WMI-Activity/Operational",
      "level": "Information",
      "title": "WMI temporary event subscription registered",
      "summary": "A temporary (non-persistent) WMI event subscription was registered.",
      "details": "Generated when a temporary WMI event subscription is created. Temporary subscriptions exist only in memory and do not survive a reboot, unlike permanent subscriptions (EID 5861). While less commonly used for persistence than permanent subscriptions, temporary subscriptions can be used for in-session lateral movement triggers or to respond to specific system conditions during an active intrusion.",
      "category": "WMI Subscription",
      "tags": [
        "wmi",
        "subscription",
        "persistence",
        "lateral-movement"
      ],
      "relatedEventIds": [
        {
          "id": 5861,
          "log": "WMI"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1047",
          "techniqueName": "Windows Management Instrumentation",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        },
        {
          "techniqueId": "T1546.003",
          "techniqueName": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
          "tactics": [
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Examine the Query field for suspicious event filters (e.g., triggering on process creation or logon events)",
          "Correlate the registering process with Security EID 4688 to identify what created the subscription",
          "Temporary subscriptions do not persist — if persistence is suspected, look for EID 5861 instead"
        ],
        "commonFalsePositives": [
          "Monitoring and management tools that use WMI event subscriptions",
          "PowerShell scripts using Register-WmiEvent or Register-CimIndicationEvent"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity"
      },
      "volumeIndicator": "rare",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "NamespaceName",
          "xpath": "EventData/Data[@Name='NamespaceName']",
          "description": "WMI namespace where the subscription was registered"
        },
        {
          "name": "Query",
          "xpath": "EventData/Data[@Name='Query']",
          "description": "The WMI event filter query for the subscription"
        }
      ],
      "lastReviewed": "2026-03-29"
    },
    {
      "id": 5861,
      "log": "WMI",
      "provider": "Microsoft-Windows-WMI-Activity",
      "channel": "Microsoft-Windows-WMI-Activity/Operational",
      "level": "Information",
      "title": "WMI permanent event subscription registered",
      "summary": "A persistent WMI event subscription was registered.",
      "details": "Generated when a permanent WMI event subscription is created — the most forensically significant WMI event for DFIR. Permanent subscriptions survive reboots and consist of three components: an EventFilter (defines the trigger condition), an EventConsumer (defines the action to execute), and a FilterToConsumerBinding (links them). CommandLineEventConsumer and ActiveScriptEventConsumer are the two consumer types most commonly abused for code execution.",
      "category": "WMI Subscription",
      "tags": [
        "wmi",
        "subscription",
        "persistence",
        "lateral-movement"
      ],
      "relatedEventIds": [
        {
          "id": 5857,
          "log": "WMI"
        },
        {
          "id": 5860,
          "log": "WMI"
        },
        {
          "id": 19,
          "log": "Sysmon"
        },
        {
          "id": 20,
          "log": "Sysmon"
        },
        {
          "id": 21,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1047",
          "techniqueName": "Windows Management Instrumentation",
          "tactics": [
            {
              "tacticId": "TA0002",
              "tacticName": "Execution"
            }
          ]
        },
        {
          "techniqueId": "T1546.003",
          "techniqueName": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
          "tactics": [
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Check Consumer type: CommandLineEventConsumer or ActiveScriptEventConsumer indicate code execution capability",
          "Examine Query for event filters that trigger on process creation, logon, or system startup",
          "Query WMI namespace root\\subscription for __EventFilter, __EventConsumer, and __FilterToConsumerBinding objects to enumerate all active subscriptions",
          "Correlate with Security EID 4688 to identify which process registered the subscription"
        ],
        "commonFalsePositives": [
          "Legitimate software using WMI subscriptions for monitoring or self-healing (e.g., some AV products, backup agents)",
          "SCCM and other endpoint management tools"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity"
      },
      "detectionRules": [
        {
          "platform": "KQL",
          "title": "WMI Permanent Event Subscription Registered",
          "rule": "Event\n| where Source == \"Microsoft-Windows-WMI-Activity\"\n| where EventID == 5861\n| parse EventData with * 'Consumer=\"' Consumer '\"' *\n| where Consumer has_any (\"CommandLineEventConsumer\", \"ActiveScriptEventConsumer\")\n| project TimeGenerated, Computer, Consumer, EventData\n| order by TimeGenerated desc",
          "notes": "CommandLineEventConsumer and ActiveScriptEventConsumer are code execution consumers. Enumerate all active subscriptions via WMI query: SELECT * FROM __EventFilter WHERE Name != '__TimerNextFiring'"
        },
        {
          "platform": "Sigma",
          "title": "WMI Permanent Event Subscription Created",
          "rule": "title: WMI Permanent Event Subscription Registered\nstatus: stable\nlogsource:\n  product: windows\n  service: wmi\ndetection:\n  selection:\n    EventID: 5861\n    Consumer|contains:\n      - 'CommandLineEventConsumer'\n      - 'ActiveScriptEventConsumer'\n  condition: selection\nfalsepositives:\n  - Legitimate AV/EDR or SCCM subscriptions\nlevel: high"
        }
      ],
      "volumeIndicator": "rare",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "NamespaceName",
          "xpath": "EventData/Data[@Name='NamespaceName']",
          "description": "WMI namespace where the subscription was registered"
        },
        {
          "name": "Query",
          "xpath": "EventData/Data[@Name='Query']",
          "description": "The event filter query defining the trigger condition"
        },
        {
          "name": "Consumer",
          "xpath": "EventData/Data[@Name='Consumer']",
          "description": "The event consumer name and type (CommandLineEventConsumer and ActiveScriptEventConsumer are most commonly abused)"
        }
      ],
      "lastReviewed": "2026-04-10"
    }
  ]
}