WMI Permanent Event Subscription - Sysmon
This search looks for the creation of WMI permanent event subscriptions.
WMI Permanent Event Subscription - Sysmon Help
To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
Open in Search