wmi-event-subscriptions

WMI Event Subscriptions (Persistence)

When to Use

• When you have elevated access (Local Admin or SYSTEM) on a Windows target and need persistence that survives reboots while evading standard Autoruns and Scheduled Task enumeration.
• When standard persistence mechanisms (Registry Run keys, Scheduled Tasks) are closely monitored by EDR and you need to live deeper in the OS.
• To execute "fileless" payloads stored entirely within the WMI repository (C:\Windows\System32\wbem\Repository\OBJECTS.DATA), outside the traditional filesystem.
• To attach payloads to conditional triggers — for example, launching a keylogger only when the user opens keepass.exe or chrome.exe.

When NOT to use: For initial access payload delivery, use phishing-payload-generation. For registry-based persistence, use standard Run key techniques. For service-based persistence that's simpler but noisier, use Scheduled Tasks.

Prerequisites

• Administrative or SYSTEM-level access on the target Windows host
• PowerShell execution (not in Constrained Language Mode)
• Understanding of WQL (WMI Query Language) for custom triggers
• A staged payload (reverse shell, C2 beacon) ready for execution

Workflow

Phase 1: Understanding the WMI Persistence Triad

# WMI Event Subscriptions require three interconnected components stored in
# the WMI repository (C:\Windows\System32\wbem\Repository):

# 1. Event Filter (__EventFilter):
#    A WQL query defining WHAT system event to monitor.
#    Think of it as: "Watch for the exact moment when [condition] occurs."
#    Example: "Trigger when system uptime exceeds 3 minutes after boot."

# 2. Event Consumer (CommandLineEventConsumer or ActiveScriptEventConsumer):
#    The malicious ACTION to execute when the filter's condition is met.
#    Think of it as: "When triggered, run this hidden PowerShell beacon."
#    Types:
#      - CommandLineEventConsumer → executes a command line (most common)
#      - ActiveScriptEventConsumer → executes VBScript/JScript inline
#      - LogFileEventConsumer → writes to a log (useful for staging)
#      - SMTPEventConsumer → sends email (rare in attacks)

# 3. FilterToConsumerBinding (__FilterToConsumerBinding):
#    The LINK that marries a specific Filter to a specific Consumer.
#    Without this binding, the Filter watches and Consumer waits, but
#    nothing connects them. This is what activates the persistence.