Detecting Persistence: Autoruns, Tasks, Services and WMI Subscriptions

To survive reboots, attackers write to a finite set of autostart locations: registry run keys, scheduled tasks, services, WMI event subscriptions, the startup folder and BITS jobs. This pack lists the telemetry for each. Persistence is highly detectable because the target locations are well-known — baseline them and alert on change.

Signals at a Glance

The Stealthy One: WMI Subscriptions

WMI event-consumer persistence is a favourite because it survives reboot and leaves little on disk. Enable Sysmon WMI events (19/20/21) and alert on the creation of permanent event filters and command-line/active-script consumers:

title: WMI Event Subscription Persistence
logsource:
    product: windows
    category: wmi_event
detection:
    selection:
        EventID:
            - 20   # WmiEventConsumer (CommandLineEventConsumer / ActiveScript)
            - 21   # WmiEventConsumerToFilter binding
    condition: selection
level: high

Baseline and Alert on Change

• Snapshot autostart locations across the fleet (Autoruns/Sysinternals or an EDR query) and alert on new or changed entries, especially those pointing to user-writable paths or script interpreters.
• Alert on scheduled-task creation (Event 4698) and service installs (7045) outside change windows, and on tasks that run at logon or on a short interval.
• Watch for Run-key writes (Sysmon 13), startup-folder file creation, and BITS job creation used to re-fetch payloads.