WMI Event ID 5861: WMI permanent event consumer registered
Written when a permanent WMI event subscription (filter and consumer) is created.
- Log
- Microsoft-Windows-WMI-Activity/Operational
- Category
- Persistence
Why it matters
- WMI subscriptions are a stealthy persistence method that runs code when a condition is met, such as at boot.
What to check
Read the consumer details (CommandLineEventConsumer or ActiveScriptEventConsumer) and the query in the filter.
How to turn it on
Logged by default on Windows 10 / Server 2016 and later.
MITRE ATT&CK
- T1546.003 WMI Event Subscription
- T1047 Windows Management Instrumentation