Sysmon Event ID 19: WmiEvent - WmiEventFilter activity detected
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 19 records WMI event filter registration activity.
Technical Metadata
| Event ID | 19 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0003 Persistence / T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription |
| Key fields to watch | EventNamespace, Name, Query |
Trigger Scenarios
Sysmon emits this event when a WMI event filter is registered. Microsoft documents that the event records the WMI namespace, filter name, and filter expression.
Key Fields
EventNamespace
The namespace where the filter is registered. root\\subscription is the standard namespace for permanent WMI event subscriptions and should be tightly baselined.
Name
The WMI filter name recorded by Sysmon. New or randomized names outside the approved management baseline can identify persistence setup.
Query
The filter expression recorded by Sysmon. Queries such as SELECT * FROM __InstanceCreationEvent define the trigger that can later execute a bound consumer.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 19
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=19
| table _time, host, EventCode, Message- Data source
- Splunk Windows Sysmon event data
- Assumptions
- Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
dataset = microsoft_windows_raw
| filter edr_event_id = 19- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
title: Sysmon Event ID 19
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 19
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This retrieves the event and is not a standalone malicious-behavior detection.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventNamespace | root\subscription | The standard namespace for permanent WMI event subscriptions. | Interpret EventNamespace with the full event and correlated activity; this value alone is not proof of compromise. Source |
| Query | WQL expression | The event filter expression that determines when the subscription triggers. | Interpret Query with the full event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription
Detection Notes
Alert when EventNamespace=root\\subscription and Query contains SELECT * FROM __InstanceCreationEvent, __InstanceModificationEvent, or __TimerEvent with a WQL polling window=60 seconds or another short WITHIN value outside the approved management baseline. Microsoft documents Event 19 as recording the WMI namespace, filter name, and filter expression; MITRE T1546.003 describes WMI event subscriptions as filters, consumers, and bindings that execute code when an event occurs. Correlate the filter Name with Sysmon Events 20 and 21 to prove the subscription chain before containment.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
Sample Log
UtcTime: 2026-07-13 01:00:00.000
EventNamespace: root\\subscription
Name: UpdaterFilter
Query: SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process'Frequently Asked Questions
What does Sysmon Event ID 19 mean?
A WMI event filter was registered.
Does Event ID 19 always indicate malicious activity?
No. Management and monitoring products can install permanent subscriptions.
How should Event ID 19 be investigated?
Inspect namespace, name and query and correlate matching consumer and binding Events 20 and 21.
Sources
- 19: WmiEvent - WmiEventFilter activity detected
Microsoft Sysinternals · vendor
- Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule