🪤 WMI Subscription Trap

Fake WMI event subscriptions that alert on modification.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Create fake WMI event subscriptions that appear to execute persistence mechanisms. Attacker enumeration of WMI subscriptions (via wmic, PowerShell Get-WMIObject) reveals the honey subscription, and any modification triggers an alert.

Implementation requirements

Windows WMI write access
Create __EventFilter + CommandLineEventConsumer pairs with attractive names
Monitor: Sysmon Event ID 19/20/21 (WMI Events)
Rollback: Remove all three parts of the subscription: the event filter, the consumer and the binding.
Upkeep: Check after patching or endpoint-tool changes that the subscription still exists. Quarterly proof-of-life query.

Technologies

Windows

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1047 Windows Management Instrumentation	Execution	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1047 Windows Management Instrumentation as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1047 to its Lures activity. No source shows how a WMI subscription trap observes WMI execution.
T1546.003 Windows Management Instrumentation Event Subscription	Privilege Escalation	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1546.003 Windows Management Instrumentation Event Subscription as an adversary behaviour. No source shows how a decoy subscription observes the attacker's own subscription.

Evidence

MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Cutting Edge Trends in Deception Based Intrusion Detection Systems" — Aegis-Edge Research, 2026.