A WMI subscriber was created

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Impacket Analytics
ATT&CK Tactic	Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK Technique	Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003)
Severity	Informational

A WMI subscriber was created.

Command execution and persistence on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.