Log Dejargonizer

Sysmon · Event 21

Sysmon Event 21: A WMI filter was bound to a consumer

The trigger and the payload were linked together. This is the moment WMI persistence actually becomes active — a filter and a consumer sitting unbound do nothing at all.

Also written as Sysmon 21Sysmon Event ID 21wmi binding persistence

What it means for you

For an analyst

Treat this as the commit point. Seeing 19 and 20 without 21 means someone built the parts but nothing runs; seeing 21 means it is armed. It is also the event most worth alerting on if you want a single high-confidence WMI rule, because a binding is meaningless outside a working subscription.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
WmiEventConsumerToFilter activity detected:
  RuleName: T1546.003
  EventType: WmiBindingEvent
  UtcTime: 2026-08-28 09:18:05.902
  Operation: Created
  User: CORP\jbrooks
  Consumer: "__EventConsumer.Name=\"WindowsUpdateConsumer\""
  Filter: "__EventFilter.Name=\"WindowsUpdateFilter\""

The fields that decide it

Everything else in the log line is context.

Operation
Created or removed. Creation arms the subscription.
Consumer
The consumer being bound, naming what will run.
Filter
The filter being bound, naming what triggers it.
User
The account that created the binding.

Ordinary reasons this happens

Most of the time it is one of these.

  • Monitoring and management software completing its own subscription setup.
  • Vendor management agents.
  • In-house automation using WMI subscriptions.

When it is not ordinary

Activating fileless WMI persistence.

What gives it awayA binding created shortly after a filter and consumer by the same session, with no management software involved.

ATT&CK T1546.003

Re-arming persistence after partial cleanup.

What gives it awayA binding created without new filter and consumer events, meaning the other parts already existed on the machine.

ATT&CK T1546.003

What to do next

  1. Find the matching Events 19 and 20 to see the trigger and the payload together.
  2. If only the binding appears, the filter and consumer already existed — enumerate them directly.
  3. Confirm whether known management software accounts for the subscription.
  4. To remove, delete all three objects from root\subscription rather than just the binding.
  5. Check other machines for the same subscription names.

Queries to run

kql The commit point for WMI persistence. Very low volume. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 21 | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated desc
powershell Active bindings on a machine — what is armed right now, regardless of when it was created. 
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding | Select-Object Filter, Consumer

Common questions

Why does the binding matter more than the filter or consumer?

Because a filter and a consumer sitting unbound do nothing. The binding is what connects the trigger to the payload and makes the persistence live. If you want one high-confidence WMI alert rather than three, this is the event to use.

What if I see Event 21 without Events 19 and 20?

The filter and consumer already existed on the machine, so only the binding is new. That usually means the persistence was built earlier, or partially cleaned up and re-armed. Enumerate root\subscription directly to see what is actually there.

Read next

Vendor documentation

Last reviewed 28 August 2026