ETW vs EVTX vs WMI Subscriptions — When Each Source Helps

Not all Windows telemetry flows through EVTX. Understanding the three telemetry layers — ETW, EVTX, and WMI — tells you what’s visible, what’s fast, and what attackers can tamper with.

The Three Telemetry Layers

┌─────────────────────────────────────────────────────────────┐
│                    Application Code                          │
│          (writes events via Win32 API / WMI)                │
└───────────────────────┬─────────────────────────────────────┘
                        │
                        ▼
┌─────────────────────────────────────────────────────────────┐
│                 ETW (Event Tracing for Windows)              │
│   Kernel-level, in-memory ring buffer, nanosecond timestamps │
│   Providers: OS, drivers, .NET, security software           │
│   Consumers: Sysmon, EDR, ETW-aware tools, Event Log svc    │
└───────────────────────┬─────────────────────────────────────┘
                        │ (subset, via Event Log service)
                        ▼
┌─────────────────────────────────────────────────────────────┐
│           EVTX (Windows Event Log / .evtx files)             │
│   Persistent on-disk, accessible via Event Viewer / API      │
│   Tampered by: `wevtutil cl Security`, ClearEventLog()      │
│   Does NOT include all ETW providers — only registered ones  │
└─────────────────────────────────────────────────────────────┘

What ETW provides beyond EVTX

ETW providers include:

• Microsoft-Windows-Kernel-Process — every process creation/termination at the kernel level (used by Sysmon internally)
• Microsoft-Windows-DotNETRuntime — .NET CLR events (method invocations, exceptions, JIT compilation) — critical for detecting fileless .NET attacks
• Microsoft-Windows-Threat-Intelligence — KERNEL_THREATINT_TASK_PROTECTVM events when suspicious memory operations occur — used by EDRs for shellcode detection
• Microsoft-Windows-DNS-Client — every DNS resolution request

WMI: The Invisible Persistence Layer

Windows Management Instrumentation (WMI) is a management framework that most users never see. Attackers use it for:

1. Reconnaissance — wmic process get Name,ProcessId,ParentProcessId,CommandLine
2. Lateral movement — Invoke-WmiMethod to execute commands on remote hosts
3. Persistence — WMI Permanent Event Subscriptions

WMI Persistence Anatomy

A WMI subscription has three components:

# The Attacker's Setup (one-liner for illustration)

# 1. Filter — what event triggers the action
$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name = "PersistenceFilter"
    EventNameSpace = "root\CIMV2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

# 2. Consumer — what to execute
$Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{
    Name = "PersistenceConsumer"
    CommandLineTemplate = "powershell.exe -enc <base64-payload>"
}

# 3. Binding — arm the persistence
$Binding = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{
    Filter = $Filter
    Consumer = $Consumer
}

Every 60 seconds, the filter fires, triggering PowerShell to run the encoded payload. This persists across reboots. It doesn’t appear in Task Scheduler. It’s not a registry key. It’s stored in the WMI repository at %SystemRoot%\System32\wbem\Repository\.

Detecting WMI Persistence

Sysmon Events 19/20/21 are your primary detection:

Event 19 (WmiEventFilter activity detected):
  EventNamespace: root\subscription
  Name: PersistenceFilter
  Query: SELECT * FROM __InstanceModificationEvent...

Event 20 (WmiEventConsumer activity detected):
  Consumer: CommandLineEventConsumer
  Name: PersistenceConsumer
  Destination: powershell.exe -enc <base64>

Event 21 (WmiEventConsumerToFilter activity detected):
  Consumer: CommandLineEventConsumer.Name="PersistenceConsumer"
  Filter: __EventFilter.Name="PersistenceFilter"

A Sigma rule for this:

title: WMI Permanent Event Subscription
id: 0f06a3a5-6a09-413f-8d0b-c7f66e4a8c6c
status: stable
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID:
      - 19
      - 20
      - 21
  condition: selection
falsepositives:
  - Legitimate WMI-based monitoring software (e.g., SCCM, Tanium)
level: high