Lion Cipher Lab
Detect WMI event-subscription persistence from telemetry
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
WMI event subscriptions are a favourite persistence trick because they are fileless: no program on disk, no Run key, no Startup folder — the trigger and the payload live inside the WMI repository and survive every reboot. A SOC that only watches files and autorun keys never sees it. But the telemetry that reveals it is a minefield of legitimate look-alikes: your patch-management agent, your laptop vendor's health monitor, and your log forwarder all create real WMI consumers that run commands on a schedule. A rule written the obvious way pages the analyst on every one of them. Learning to…
What you'll learn
- Reading Sysmon WMI telemetry (EID 19 filter, 20 consumer, 21 binding)
- Mapping MITRE ATT&CK T1546.003 to observable events
- Writing detections keyed on consumer type, command content, and a publisher allowlist
- Measuring detection precision and recall against a labeled dataset
- Tuning out legitimate management-agent subscriptions (SCCM, Dell, HP, MMA)
- Naming detection blind spots (pre-logging subscriptions, allowlist mimicry) and the repository baseline hunt
Steps in this lab
- What WMI persistence looks like from the outside
- The three Sysmon events that carry the signal
- Generate a labeled dataset
- Write the naive detection and measure it
- Tune it: consumer type, content, and a publisher allowlist
- Name what the telemetry cannot see