Sysmon Event ID 21

21: WmiEventConsumerToFilter activity detected

This is an event from Sysmon.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Attackers have developed a particularly sophisticated way to persist malware perhaps elevate privileges with WMI Event Filters and Consumers.

WMI allows you to link these 2 objects in order to execute a custom action whenever specified things happen in Windows. WMI events are related to but more general than the events we all know and love in the event log. WMI events include system startup, time intervals, program execution and many, many other things. You can define a __EventFilter which is basically a WQL query that specifies what events you want to catch in WMI. This is a permanent object saved in the WMI repository. It’s passive until you create a consumer and link them with a binding. The WMI event consumer defines what the system should do with any events caught by the filter. There are different kinds of event consumers for action like running a script, executing a command line, sending an email or writing to a log file. Finally, you link the filter and consumer with a __FilterToConsumerBinding. After saving the binding, everything is now active and whenever events matching the filter occur, they are fed to the consumer. 

This event tells you when a WMI event filter (Event ID 19) is connected to a consumer (Event ID 20).  In an attack this is the final of 3 steps.  

To learn more about this kind of attack see my blog https://www.ultimatewindowssecurity.com/blog/default.aspx?d=06/2018

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 21

• Log Name
• Source
• Date
• Event ID
• Task Category
• Level
• Keywords
• User
• Computer
• Description
• EventType
• UtcTime
• Operation
• User
• Consumer
• Filter

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

Mini-Seminars Covering Event ID 21 Using Sysmon v6.01 to Really See What’s Happening on Endpoints; It’s Better than the Windows Security Log Using New Events in Sysmon v13 to Detect Sophisticated Attacks

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy