Sysmon Event ID 21: WmiEvent - WmiEventConsumerToFilter activity detected
Sysmon Event ID 21 records WMI consumer-to-filter binding activity.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a WMI consumer is bound to a filter. Microsoft documents that the event records the consumer name and filter path.
Key Fields
Consumer
The bound consumer name recorded by Sysmon. This should match a recent or existing Event 20 consumer.
Filter
The filter path recorded by Sysmon. A path in root\\subscription that references a new Event 19 filter completes the WMI subscription chain.
Operation
Use the operation context to distinguish new bindings from expected management changes, then correlate to the filter and consumer records.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription
Detection Notes
Alert when Filter points to root\\subscription and Consumer links to an unapproved Event 20 consumer whose Destination executes from C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp, because Event 21 is the binding that turns a passive WMI filter into an executable subscription chain. Microsoft documents Event 21 as recording the consumer name and filter path; MITRE T1546.003 describes WMI subscriptions as filters, consumers, and bindings that execute code on events. Correlate Consumer and Filter values with Events 19 and 20, then remove the binding before deleting only isolated artifacts.
Sysmon
| where EventID == 21
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=21 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
Consumer: UpdaterConsumer
Filter: root\\subscription:__EventFilter.Name="UpdaterFilter"
Operation: Created