Detection rules › By event

Microsoft-Windows-Sysmon event 21

4 detection rules reference this event. View event page.

Sigma (3)

Suspicious Encoded Scripts in a WMI Consumer severity high T1047, T1546.003
Suspicious Scripting in a WMI Consumer severity high T1059.005
WMI Event Subscription severity medium T1546.003

Splunk (1)

WMI Permanent Event Subscription - Sysmon T1546.003