About

Imported from mukul975/anthropic-cybersecurity-skills (skills/detecting-wmi-persistence/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill detecting-wmi-persistence. Copyright stays with the author (Apache-2.0).

Detecting WMI Persistence

Name: detecting-wmi-persistence
Author: mukul975

When to Use

When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
After detecting suspicious WMI activity in endpoint telemetry
During incident response to identify attacker persistence mechanisms
When Sysmon alerts trigger on Event IDs 19, 20, or 21
During purple team exercises testing WMI-based persistence

Prerequisites

Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
Windows Security Event Log forwarding configured
SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
PowerShell access for WMI enumeration on endpoints
Sysinternals Autoruns for manual WMI subscription review

Workflow

Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
Document and Remediate: Remove malicious subscriptions and update detection rules.

Key Concepts

Concept	Description
Sysmon Event 19	WmiEventFilter creation detected
Sysmon Event 20	WmiEventConsumer creation detected
Sysmon Event 21	WmiEventConsumerToFilter binding detected
T1546.003	Event Triggered Execution: WMI Event Subscription
CommandLineEventConsumer	Executes system commands when filter triggers
ActiveScriptEventConsumer	Runs VBScript/JScript when filter triggers

Tools & Systems

Tool	Purpose
Sysmon	Windows event monitoring for WMI activity
WMI Explorer	GUI tool for browsing WMI namespaces
Autoruns	Sysinternals tool listing persistence mechanisms
PowerShell Get-WMIObject	Enumerate WMI event subscriptions
Splunk	SIEM analysis of Sysmon WMI events
Velociraptor	Endpoint WMI artifact collection

Output Format

Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-wmi-pe-0813e1/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-detecting-wmi-pe-0813e1.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-detecting-wmi-pe-0813e1",
  "kind": "skill",
  "name": "detecting-wmi-persistence",
  "description": "Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "customer_support"
    ],
    "tags": [
      "skill-md",
      "threat-hunting",
      "wmi",
      "persistence",
      "sysmon",
      "t1546-003",
      "mitre-attack",
      "windows",
      "dfir",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/detecting-wmi-persistence/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/detecting-wmi-persistence/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/detecting-wmi-persistence/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Detecting WMI Persistence\n\n## When to Use\n\n- When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)\n- After detecting suspicious WMI activity in endpoint telemetry\n- During incident response to identify attacker persistence mechanisms\n- When Sysmon alerts trigger on Event IDs 19, 20, or 21\n- During purple team exercises testing WMI-based persistence\n\n## Prerequisites\n\n- Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)\n- Windows Security Event Log forwarding configured\n- SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)\n- PowerShell ac",
  "cost": {
    "context_tokens": 676
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-wmi-pe-0813e1/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.