SOC Event Lookup
Event ID 19WMIP2

Sysmon Event ID 19: WmiEvent - WmiEventFilter activity detected

Sysmon Event ID 19 records WMI event filter registration activity.

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-13

Trigger Scenarios

Sysmon emits this event when a WMI event filter is registered. Microsoft documents that the event records the WMI namespace, filter name, and filter expression.

Key Fields

EventNamespace

The namespace where the filter is registered. root\\subscription is the standard namespace for permanent WMI event subscriptions and should be tightly baselined.

Name

The WMI filter name recorded by Sysmon. New or randomized names outside the approved management baseline can identify persistence setup.

Query

The filter expression recorded by Sysmon. Queries such as SELECT * FROM __InstanceCreationEvent define the trigger that can later execute a bound consumer.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

MITRE ATT&CK Mapping

  • T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription

Detection Notes

Alert when EventNamespace=root\\subscription and Query contains SELECT * FROM __InstanceCreationEvent, __InstanceModificationEvent, or __TimerEvent with a WQL polling window=60 seconds or another short WITHIN value outside the approved management baseline. Microsoft documents Event 19 as recording the WMI namespace, filter name, and filter expression; MITRE T1546.003 describes WMI event subscriptions as filters, consumers, and bindings that execute code when an event occurs. Correlate the filter Name with Sysmon Events 20 and 21 to prove the subscription chain before containment.

Microsoft Sentinel KQL
Sysmon
| where EventID == 19
| project TimeGenerated, Computer, Image, ProcessGuid
Splunk SPL
index=sysmon EventCode=19 | table _time, host, Image, ProcessGuid
Sample Log
UtcTime: 2026-07-13 01:00:00.000
EventNamespace: root\\subscription
Name: UpdaterFilter
Query: SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process'

Source

Official documentationMachine-readable JSON