MITRE ATT&CKsub-technique

T1546.003 Windows Management Instrumentation Event Subscription

Published 2020-01-24 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Privilege Escalation, Persistence
Platforms
Windows
Version
1.5
Created
2020-01-24

Description

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may also compile WMI scripts – using `mofcomp.exe` –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1546 Event Triggered Execution technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1040 Behavior Prevention on Endpoint mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (25)

  • S1085 Sardonic software (malware)
  • S1081 BADHATCH software (malware)
  • C0024 SolarWinds Compromise campaign
  • C0023 Operation Ghost campaign
  • G1013 Metador group
  • S1059 metaMain software (malware)
  • S1020 Kevin software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0682 TrailBlazer software (malware)
  • G0129 Mustang Panda group
  • S0511 RegDuke software (malware)
  • G0108 Blue Mockingbird group
  • S0378 PoshC2 software (tool)
  • S0376 HOPLIGHT software (malware)
  • S0371 POWERTON software (malware)
  • G0075 Rancor group
  • G1001 HEXANE group
  • G0061 FIN8 group
  • G0064 APT33 group
  • G0065 Leviathan group
  • S0202 adbupd software (malware)
  • S0150 POSHSPY software (malware)
  • G0010 Turla group
  • G0016 APT29 group
  • S0053 SeaDuke software (malware)

Referenced by Compliance · mitigates (14)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SI-14 Non-persistence NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References