Windows Management Instrumentation Event Subscription
Subtechnique · ATTACK:enterprise:T1546.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1546.003",
"title": "Windows Management Instrumentation Event Subscription",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1546/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--910906dd-8c0a-475a-9cc1-5e029e2fad58",
"external_id": "T1546.003",
"domain": "enterprise",
"created": "2020-01-24T14:07:56.276Z",
"modified": "2025-10-24T17:49:06.119Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"privilege-escalation",
"persistence"
],
"source_references": [
{
"source_name": "FireEye WMI 2015",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
},
{
"source_name": "Dell WMI Persistence",
"url": "https://www.secureworks.com/blog/wmi-persistence"
},
{
"source_name": "FireEye WMI SANS 2015",
"url": "https://web.archive.org/web/20221203203722/https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf"
},
{
"source_name": "Medium Detecting WMI Persistence",
"url": "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96"
},
{
"source_name": "Elastic - Hunting for Persistence Part 1",
"url": "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1"
},
{
"source_name": "Mandiant M-Trends 2015",
"url": "https://web.archive.org/web/20160629094859/https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf"
},
{
"source_name": "Microsoft Register-WmiEvent",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/register-wmievent?view=powershell-5.1"
},
{
"source_name": "TechNet Autoruns",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
},
{
"source_name": "Microsoft MOF May 2018",
"url": "https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a666dc1-d0b9-49ac-b05b-350cfca7fa61
RedCanary Mockingbird May 2020ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32b50ea5-7e1e-4253-b2b8-ba99a054c6d9
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--337dc23f-d825-415d-886b-53c3457fbd56
Mandiant No Easy BreachATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38a350e5-634c-4dcb-8f6c-0615cdb37864
ATTACK:enterprise:T1546.003 → subtechnique-of → ATTACK:enterprise:T1546
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39084aef-6ba7-4370-832f-b10002b97804
ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46e81587-e960-4277-9c3b-af2bdc328176
SentinelLabs Metador Sept 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f7d0afb-471e-42e9-9a65-8d8aa8635ac5
Kaspersky Lyceum October 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5014ed30-309e-4bed-af86-ec5603736342
Bitdefender FIN8 July 2021ATTACK:enterprise:S0511 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--604045bc-5d44-495f-a0cb-df73bd769d90
ESET Dukes October 2019ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--670dc748-f1c8-4ba3-b999-f942fa42ce50
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b2cd244-a02f-4b76-85d9-a429a298f016
FireEye Periscope March 2018ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80475f21-fb52-4f97-a09c-ddfce82ca536
US-CERT HOPLIGHT Apr 2019ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e8aced5-9391-47d8-bef7-894453048810
Microsoft 365 Defender Solorigate · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9263ab45-f7d5-4bcf-af7e-d7be1913c3d6
ESET Turla PowerShell May 2019ATTACK:enterprise:G1013 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--944a0e0d-dfb4-4c78-a0bd-601b989365bd
SentinelLabs Metador Sept 2022ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e1bb696-e1f0-46d3-ab91-79280323d711
Microsoft Holmium June 2020ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8e5b5ae-85ca-48da-b3a0-36da1162034d
FireEye WMI 2015ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abb5f6e2-1813-4d0e-8269-cceec54b4843
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abf1b22c-a9a4-4155-832c-66878158db77
Kaspersky Lyceum October 2021ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad63da4a-163d-49b4-b923-f4df799ab183
ESET Dukes October 2019ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b063f8cf-86d1-47fb-8ada-2b39009ee9e2
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:S0202 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc249532-826d-4bc2-8b03-43f284fe609f
Microsoft PLATINUM April 2016ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9bf4d9d-b83b-49f4-b35a-5fb24f522bc7
Rancor WMIATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcbc4dd1-01e6-4ff6-b21e-572f5074f417
win10_asrATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f653eb7d-7027-4161-9071-b52336bd4fbc
FireEye WMI 2015ATTACK:enterprise:S0150 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f758836e-91b2-4651-ba72-d827553b668c
FireEye POSHSPY April 2017ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbce0681-c5d2-4ea9-b48a-4fc42448f9e0
GitHub PoshC2ATTACK:enterprise:S0682 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd1e07f7-2ec2-4af3-a90c-17d142bd8fa8
CrowdStrike StellarParticle January 2022ATTACK:enterprise:S0371 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff53be5e-2a57-4a9e-a0c1-cc075c1331c4
FireEye APT33 Guardrail