19_20_21_wmi_event/include_wmi_create.xml tags WMI Event Subscription activity as T1047, but EID 19/20/21 cover the subscription mechanism (WmiEventFilter, WmiEventConsumer, WmiEventConsumerToFilter), that's T1546.003, not T1047. T1047 is WMI execution. T1546.003 is persistence via event subscription. Different tactic, different playbook - an analyst hunting T1546.003 persistence gets nothing because all three subscription events are silently filed under WMI execution.
Current:
<Operation name="technique_id=T1047,technique_name=Windows Management Instrumentation"
condition="is">Created</Operation>Suggested:
<Operation name="technique_id=T1546.003,technique_name=WMI Event Subscription"
condition="is">Created</Operation>
Confirmed in lab running Atomic Red Team T1546.003 on Windows 11 Enterprise / Sysmon v15.20. EID 19 (WmiFilterEvent) shows technique_id=T1047 in the RuleName field (screenshot attached). The same rule in include_wmi_create.xml covers EID 20 and 21, a single Created applies to all WmiEvent types.
Before:
After:
19_20_21_wmi_event/include_wmi_create.xmltags WMI Event Subscription activity as T1047, but EID 19/20/21 cover the subscription mechanism (WmiEventFilter, WmiEventConsumer, WmiEventConsumerToFilter), that's T1546.003, not T1047. T1047 is WMI execution. T1546.003 is persistence via event subscription. Different tactic, different playbook - an analyst hunting T1546.003 persistence gets nothing because all three subscription events are silently filed under WMI execution.Current:
Suggested:
Confirmed in lab running Atomic Red Team T1546.003 on Windows 11 Enterprise / Sysmon v15.20. EID 19 (WmiFilterEvent) shows technique_id=T1047 in the RuleName field (screenshot attached). The same rule in include_wmi_create.xml covers EID 20 and 21, a single Created applies to all WmiEvent types.
Before:
After:
