WMI Permanent Event Subscription - Sysmon

Description

This search looks for the creation of WMI permanent event subscriptions.

   Help

WMI Permanent Event Subscription - Sysmon Help

To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.

   Search

Open in Search