agentsclimarketplace

Hunting wmi event subscription persistence

Skill meltedinhex/analyst-ai-pack/skills/hunting-wmi-event-subscription-persistence

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-wmi-event-subscription-persistence

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Hunting WMI Event Subscription Persistence

When to Use

  • You have Sysmon WMI telemetry (Event ID 19 filter, 20 consumer, 21 binding) or a WMI repository export and want to find malicious permanent event subscriptions.
  • You are investigating fileless persistence that survives reboots via WMI.

Do not use this for transient WMI process calls (T1047 execution) — this targets persistent __EventFilter/__EventConsumer subscriptions specifically.

Prerequisites

  • Sysmon EID 19/20/21 events (CSV/JSON) or an exported subscription listing.

Workflow

Step 1: Parse and correlate triad records

python scripts/analyst.py hunt wmi_events.csv

Groups filters, consumers, and bindings, and flags consumers whose payload is suspicious (CommandLineEventConsumer running scripts/encoded commands, ActiveScriptEventConsumer with inline VBScript/JScript).

Step 2: Assess the trigger

Inspect the __EventFilter query — common malicious triggers fire on logon, time intervals (__InstanceModificationEvent within), or process start.

Step 3: Confirm maliciousness

Legitimate management subscriptions exist; weight inline scripts, encoded commands, and unusual consumer names.

Step 4: Operationalize

Write a Sigma/EDR rule for new ActiveScript/CommandLine consumers.

Validation

  • Filter, consumer, and binding are correlated into a complete subscription where possible.
  • Suspicious consumers are flagged by payload content, not consumer existence alone.
  • Findings map to ATT&CK T1546.003.

Pitfalls

  • Legitimate monitoring tools (SCCM, antivirus) create subscriptions — corroborate.
  • Missing the binding that links an otherwise-benign-looking filter and consumer.
  • Encoded PowerShell inside a consumer obscuring intent.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.