T1546.003 Windows Management Instrumentation Event Subscription
sub-techniqueEnterpriseAdversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may also compile WMI scripts – using `mofcomp.exe` –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (3)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 5 of 12 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 4 of 12 mapped controls
- PR.DSData Securitymoderate · backed by 4 of 12 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (12)
Security controls that mitigate this.
groups (10)
Threat groups associated with this.
software (13)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (12)
Sigma detection rules related to this.
source
Where this definition is published.