Sysmon Event ID 20: WmiEvent - WmiEventConsumer activity detected
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 20 records WMI event consumer registration activity.
Technical Metadata
| Event ID | 20 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0003 Persistence / T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription |
| Key fields to watch | Name, Destination, Log |
Trigger Scenarios
Sysmon emits this event when a WMI event consumer is registered. Microsoft documents that the event records the consumer name, log, and destination.
Key Fields
Name
The WMI consumer name recorded by Sysmon. Correlate it with the Event 21 consumer path to prove a complete subscription.
Destination
The destination recorded for the consumer. Command execution destinations that reference powershell.exe, cmd.exe, or C:\\Users\\ paths are high-risk because the consumer can execute attacker content.
Log
The log field recorded by Sysmon for the consumer and useful for identifying scripted, command-line, or log-backed consumers.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 20
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=20
| table _time, host, EventCode, Message- Data source
- Splunk Windows Sysmon event data
- Assumptions
- Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
dataset = microsoft_windows_raw
| filter edr_event_id = 20- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
title: Sysmon Event ID 20
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 20
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This retrieves the event and is not a standalone malicious-behavior detection.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 20 | A WMI event consumer was registered. | Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source |
| Destination | command or script | The consumer destination that executes or handles the triggered event. | Interpret Destination with the full event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription
Detection Notes
Alert when Destination references powershell.exe, cmd.exe, wscript.exe, mshta.exe, or a payload under C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp. Microsoft documents Event 20 as recording consumer name, log, and destination, and MITRE T1546.003 covers WMI consumers used to execute code from event subscriptions. Correlate the consumer Name with Event 19 filter registration and Event 21 binding to determine whether the executable destination is armed for persistence.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
Sample Log
UtcTime: 2026-07-13 01:00:00.000
Name: UpdaterConsumer
Log: CommandLineEventConsumer
Destination: powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\ProgramData\\updater.ps1Frequently Asked Questions
What does Sysmon Event ID 20 mean?
A WMI event consumer was registered.
Does Event ID 20 always indicate malicious activity?
No. Enterprise management software can install legitimate consumers.
How should Event ID 20 be investigated?
Review destination and name and correlate the consumer with Events 19 and 21 to reconstruct the subscription.
Sources
- 20: WmiEvent - WmiEventConsumer activity detected
Microsoft Sysinternals · vendor
- Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule