CyberStack

MITRE ATT&CK / Techniques / T1546.003

Event Triggered Execution: Windows Management Instrumentation Event Subscription

ID
T1546.003
Tactics
TA0003 Persistence, TA0004 Privilege Escalation
Sub-technique of
T1546 Event Triggered Execution
Platforms
Windows
Data sources
WMI Creation, Process Creation, Module Load
Source
attack.mitre.org
MITRE last modified
25 Oct 2025

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.[3]

Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.[4][1] Adversaries may also compile WMI scripts – using mofcomp.exe –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.[5][6]

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Detection

Mitigations (3)

M1018 User Account Management

By default, only administrators are allowed to connect remotely using WMI; restrict other users that are allowed to connect, or disallow all users from connecting remotely to WMI.

M1026 Privileged Account Management

Prevent credential overlap across systems of administrator and privileged accounts.[1]

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent malware from abusing WMI to attain persistence.[2]

Groups (10)

Software (13)

References

  1. FireEye WMI 2015
  2. win10_asr
  3. Mandiant M-Trends 2015
  4. FireEye WMI SANS 2015
  5. Dell WMI Persistence
  6. Microsoft MOF May 2018