SOC Event Lookup
Event ID 21WMIP2

Sysmon Event ID 21: WmiEvent - WmiEventConsumerToFilter activity detected

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 21 records WMI consumer-to-filter binding activity.

Technical Metadata

Technical metadata for Event ID 21
Event ID21
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0003 Persistence / T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription
Key fields to watchConsumer, Filter, Operation

Trigger Scenarios

Sysmon emits this event when a WMI consumer is bound to a filter. Microsoft documents that the event records the consumer name and filter path.

Key Fields

Consumer

The bound consumer name recorded by Sysmon. This should match a recent or existing Event 20 consumer.

Filter

The filter path recorded by Sysmon. A path in root\\subscription that references a new Event 19 filter completes the WMI subscription chain.

Operation

Use the operation context to distinguish new bindings from expected management changes, then correlate to the filter and consumer records.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 21
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 21
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 21
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=21
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 21
dataset = microsoft_windows_raw
| filter edr_event_id = 21
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 21
title: Sysmon Event ID 21
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 21
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID21A WMI consumer was bound to an event filter.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
FilterWMI pathThe filter path paired with the Consumer reference.Interpret Filter with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription

Detection Notes

Alert when Filter points to root\\subscription and Consumer links to an unapproved Event 20 consumer whose Destination executes from C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp, because Event 21 is the binding that turns a passive WMI filter into an executable subscription chain. Microsoft documents Event 21 as recording the consumer name and filter path; MITRE T1546.003 describes WMI subscriptions as filters, consumers, and bindings that execute code on events. Correlate Consumer and Filter values with Events 19 and 20, then remove the binding before deleting only isolated artifacts.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
Consumer: UpdaterConsumer
Filter: root\\subscription:__EventFilter.Name="UpdaterFilter"
Operation: Created

Frequently Asked Questions

What does Sysmon Event ID 21 mean?

A WMI event consumer was bound to a filter.

Does Event ID 21 always indicate malicious activity?

No. Legitimate permanent WMI subscriptions require such bindings.

How should Event ID 21 be investigated?

Resolve both Filter and Consumer to Events 19 and 20 and verify the complete chain against baseline.

Sources