{
  "id": "21",
  "source": "sysmon",
  "category": "WMI",
  "name": "WmiEvent - WmiEventConsumerToFilter activity detected",
  "priority": "P2",
  "applicable_version": "Sysmon with this event enabled",
  "last_reviewed": "2026-07-13",
  "definition": "Sysmon Event ID 21 records WMI consumer-to-filter binding activity.",
  "trigger_scenarios": "Sysmon emits this event when a WMI consumer is bound to a filter. Microsoft documents that the event records the consumer name and filter path.",
  "key_fields": [
    {
      "field": "Consumer",
      "explanation": "The bound consumer name recorded by Sysmon. This should match a recent or existing Event 20 consumer."
    },
    {
      "field": "Filter",
      "explanation": "The filter path recorded by Sysmon. A path in root\\\\subscription that references a new Event 19 filter completes the WMI subscription chain."
    },
    {
      "field": "Operation",
      "explanation": "Use the operation context to distinguish new bindings from expected management changes, then correlate to the filter and consumer records."
    }
  ],
  "false_positives": [
    "Approved administration, management agents, and deployment tools can generate this telemetry.",
    "Baseline expected hosts, signed binaries, and change windows before suppression."
  ],
  "related_event_ids": [
    "1"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1546.003",
      "technique_name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription"
    }
  ],
  "detection_notes": "Alert when Filter points to root\\\\subscription and Consumer links to an unapproved Event 20 consumer whose Destination executes from C:\\\\Users\\\\, C:\\\\ProgramData\\\\, or C:\\\\Windows\\\\Temp, because Event 21 is the binding that turns a passive WMI filter into an executable subscription chain. Microsoft documents Event 21 as recording the consumer name and filter path; MITRE T1546.003 describes WMI subscriptions as filters, consumers, and bindings that execute code on events. Correlate Consumer and Filter values with Events 19 and 20, then remove the binding before deleting only isolated artifacts.",
  "kql_snippet": "Sysmon\n| where EventID == 21\n| project TimeGenerated, Computer, Image, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=21 | table _time, host, Image, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-13 01:00:00.000\nConsumer: UpdaterConsumer\nFilter: root\\\\subscription:__EventFilter.Name=\"UpdaterFilter\"\nOperation: Created",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/21/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/21/",
  "json_url": "/api/events/sysmon/21.json"
}