WMI Event Subscriptions
MDE WMI Event Subscription
Query
DeviceEvents
| where ActionType contains "AsrPersistenceThroughWmi"About this query
Explanation
The query is used to find activities related to WMI Event subscriptions. It includes different KQL queries to detect various methods of WMI event subscription, such as using New-CimInstance cmdlet, PowerShell commands, wmic, and mofcomp.exe. The queries can be used in Microsoft 365 Defender to audit and block events related to WMI event subscriptions.
