Detection: WMI Temporary Event Subscription

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. Temporary WMI activity may warrant a separate behavior-focused detection.

Removed in version: 6.10.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Created: 2020-04-29 Last Updated: 2026-10-23 ID: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 Author: Rico Valdez, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks.

Search

 1`wmi`
 2EventCode=5860
 3Temporary
 4
 5| rex field=Message "NotificationQuery =\s+(?<query>[^;
 6|^$]+)"
 7
 8| search
 9    query!="FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'"
10    AND
11    query!="FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'"
12
13| stats count min(_time) as firstTime
14              max(_time) as lastTime
15  by ComputerName, query
16
17| `security_content_ctime(firstTime)`
18
19| `security_content_ctime(lastTime)`
20
21| `wmi_temporary_event_subscription_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
wmi	`(source="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" OR source="XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational")`
wmi_temporary_event_subscription_filter	``

wmi_temporary_event_subscription_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational].

Known False Positives

Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.

Associated Analytic Story

No associated analytic story

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 11