Log Dejargonizer

Sysmon · Event 20

Sysmon Event 20: A WMI event consumer was registered

Something registered what to run when a WMI condition fires. This is the payload half of WMI persistence, and unlike the filter it names the actual command — which makes it the most directly useful of the three WMI events.

Also written as Sysmon 20Sysmon Event ID 20WmiEventConsumer activity detectedwmi consumer persistence

What it means for you

For an analyst

The Destination field holds the payload — a command line for a CommandLineEventConsumer, or a script body for an ActiveScriptEventConsumer. Those two consumer types are the ones used offensively; the logging and SMTP consumers are far less interesting. A consumer without a binding does nothing, but its presence alone is worth investigating.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
WmiEventConsumer activity detected:
  RuleName: T1546.003
  EventType: WmiConsumerEvent
  UtcTime: 2026-08-28 09:18:04.117
  Operation: Created
  User: CORP\jbrooks
  Name: "WindowsUpdateConsumer"
  Type: Command Line
  Destination: "powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3..."

The fields that decide it

Everything else in the log line is context.

Type
The consumer class, which tells you what kind of payload it is.
  • CommandLineEventConsumerRuns a command line. The most common in attacks.
  • ActiveScriptEventConsumerRuns VBScript or JScript inline, with no file on disk.
  • LogFileEventConsumerWrites to a log file. Rarely used offensively.
  • NTEventLogEventConsumerWrites an event log entry. Benign.
Name
The consumer's name. Frequently made to resemble a Windows component.
Destination
What actually runs. For a command line consumer this is the command; for a script consumer it is the script itself. This is the field to read.
Operation
Created or removed. Creation is what matters.
User
The account that registered it.

Ordinary reasons this happens

Most of the time it is one of these.

  • Monitoring and management software using WMI subscriptions.
  • Hardware vendor agents reacting to system conditions.
  • Enterprise inventory tooling.
  • Occasional in-house automation.

When it is not ordinary

The payload half of fileless WMI persistence.

What gives it awayA CommandLineEventConsumer or ActiveScriptEventConsumer whose destination runs a shell, a scripting engine, or an encoded command.

ATT&CK T1546.003

A script payload that never touches disk.

What gives it awayAn ActiveScriptEventConsumer with the script body stored inline in the WMI repository.

ATT&CK T1546.003

A consumer named to look like a Windows component.

What gives it awayA name imitating a Microsoft feature with a destination that does not match it.

ATT&CK T1036.005

What to do next

  1. Read the Destination field. It is the payload and usually settles the question.
  2. Check the consumer type — command line and active script are the offensive ones.
  3. Look for matching Events 19 and 21. All three are needed for it to actually fire.
  4. Enumerate existing consumers on the machine, since anything predating your collection will not appear here.
  5. If malicious, remove the filter, the consumer, and the binding — removing one leaves the rest behind.

Queries to run

kql Low volume and carries the payload. Worth reading every entry. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 20 | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated desc
powershell Existing consumers with their payloads, including any created before Sysmon was collecting. 
Get-WmiObject -Namespace root\subscription -Class __EventConsumer | Select-Object __CLASS, Name, CommandLineTemplate, ScriptText

Common questions

What is a WMI event consumer?

The part of a WMI subscription that defines what happens when the trigger condition is met. A CommandLineEventConsumer runs a command; an ActiveScriptEventConsumer runs a script stored inline in the WMI repository, with nothing written to disk. It is the payload half of the technique.

Which of the three WMI events matters most?

Event 20, because it names the payload. The filter tells you when something fires and the binding tells you the two are linked, but the consumer tells you what actually runs — which is usually the answer you need.

Read next

Vendor documentation

Last reviewed 28 August 2026