Detection rules › By eventMicrosoft-Windows-WMI-Activity event 211 detection rule reference this event. View event page.Elastic (1)Suspicious WMI Event Subscription Created T1546, T1546.003