{
  "id": "19",
  "source": "sysmon",
  "category": "WMI",
  "name": "WmiEvent - WmiEventFilter activity detected",
  "priority": "P2",
  "applicable_version": "Sysmon with this event enabled",
  "last_reviewed": "2026-07-13",
  "definition": "Sysmon Event ID 19 records WMI event filter registration activity.",
  "trigger_scenarios": "Sysmon emits this event when a WMI event filter is registered. Microsoft documents that the event records the WMI namespace, filter name, and filter expression.",
  "key_fields": [
    {
      "field": "EventNamespace",
      "explanation": "The namespace where the filter is registered. root\\\\subscription is the standard namespace for permanent WMI event subscriptions and should be tightly baselined."
    },
    {
      "field": "Name",
      "explanation": "The WMI filter name recorded by Sysmon. New or randomized names outside the approved management baseline can identify persistence setup."
    },
    {
      "field": "Query",
      "explanation": "The filter expression recorded by Sysmon. Queries such as SELECT * FROM __InstanceCreationEvent define the trigger that can later execute a bound consumer."
    }
  ],
  "false_positives": [
    "Approved administration, management agents, and deployment tools can generate this telemetry.",
    "Baseline expected hosts, signed binaries, and change windows before suppression."
  ],
  "related_event_ids": [
    "1"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1546.003",
      "technique_name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription"
    }
  ],
  "detection_notes": "Alert when EventNamespace=root\\\\subscription and Query contains SELECT * FROM __InstanceCreationEvent, __InstanceModificationEvent, or __TimerEvent with a WQL polling window=60 seconds or another short WITHIN value outside the approved management baseline. Microsoft documents Event 19 as recording the WMI namespace, filter name, and filter expression; MITRE T1546.003 describes WMI event subscriptions as filters, consumers, and bindings that execute code when an event occurs. Correlate the filter Name with Sysmon Events 20 and 21 to prove the subscription chain before containment.",
  "kql_snippet": "Sysmon\n| where EventID == 19\n| project TimeGenerated, Computer, Image, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=19 | table _time, host, Image, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-13 01:00:00.000\nEventNamespace: root\\\\subscription\nName: UpdaterFilter\nQuery: SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process'",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/19/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/19/",
  "json_url": "/api/events/sysmon/19.json"
}