ASD ISM 2129Centrally Log WMI Activity and Event Subscriptions
All Windows Management Instrumentation actions are tracked in a central log, including event subscriptions.
Plain language
This control is about keeping a detailed record of everything that happens within Windows Management Instrumentation, or WMI. WMI is a part of Windows used by many applications and system administrators to query, configure and automate Windows hosts. Because WMI is trusted and present on every Windows system, attackers also use it, and permanent event subscriptions are a well-known persistence technique: an adversary registers a subscription that quietly runs their code whenever a chosen event occurs, surviving reboots without leaving an obvious file or scheduled task behind. By logging all WMI activity centrally, especially the creation of permanent event subscriptions, you can spot this kind of unusual or harmful behaviour even if the attacker later clears the logs on the host itself.
Framework
ASD Information Security Manual (ISM)
Control effect
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
05 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Operating system hardeningTopic
Windows Management Instrumentation
Official control statement
WMI activity, including the creation of permanent event subscriptions, is centrally logged.
Why it matters
Without logging WMI activity centrally, suspicious actions like unauthorised system modifications or malware could go unnoticed. This lack of visibility increases the risk of attacks and compromises being missed, leading to potential data theft or system damage.
Operational notes
Regularly review WMI logs to identify any unusual activity patterns or new permanent event subscriptions. Update alert conditions in line with emerging threats or changes in the IT environment. Ensure that all systems are consistently configured to log and forward WMI activity to prevent gaps in monitoring. Also, refresh and test audit processes to confirm they remain effective and responsive to new WMI behaviour and system updates.
Implementation tips
- Configure Windows Event Forwarding to send WMI logs from all computers in the network to a central logging server. This helps in tracking all activities and keeping a centralised record.
- Ensure WMI event logging is enabled by confirming the 'Microsoft-Windows-WMI-Activity/Operational' log is turned on and capturing relevant activities. It is enabled by default on supported Windows versions, so enforce and verify the setting fleet-wide through Group Policy, wevtutil or your configuration management tooling rather than adjusting each machine by hand.
- Set up alerts in your logging system for specific WMI tasks that might indicate malicious intent, such as creating new event subscriptions without proper authorisation.
- Use tools like PowerShell to regularly audit existing WMI event subscriptions on each machine to ensure they match expected configurations. This can help identify any unauthorised changes.
- Reconcile the list of Windows hosts reporting WMI activity to the central logging server against your asset inventory, and investigate and fix any host that has stopped forwarding so that central logging remains complete.
Audit / evidence tips
- AskRequest the configuration settings for Windows Event Forwarding used to centralise WMI logs.Look atCheck that the forwarding settings include all necessary endpoints and that logs are being sent to a central server.GoodA properly configured system where logs from all endpoints are being forwarded and received by the central server.
- AskAsk for evidence of enabled WMI logging, specifically the Microsoft-Windows-WMI-Activity/Operational log settings.Look atVerify that the operational log for WMI activity is enabled and collecting the appropriate level of detail.GoodLogging is enabled with settings that capture all important WMI activities, including event subscriptions.
- AskRequest documentation on WMI-related alerts set up in the central logging system.Look atExamine the list of alerts to ensure they cover critical activities like unauthorised WMI event subscriptions.GoodA comprehensive set of alerts that correctly flags potentially suspicious WMI activities.
- AskAsk for recent audit reports of WMI event subscriptions.Look atLook for discrepancies between the current state of event subscriptions and the expected configurations.GoodAudit reports show that all WMI event subscriptions are known and authorised, with no unexpected configurations.
- AskRequest a comparison of the Windows hosts reporting WMI activity to the central logging server against the asset inventory.Look atCheck for in-scope Windows hosts that are missing from the central log or have stopped forwarding, and how such gaps are detected and resolved.GoodEvery in-scope Windows host is represented in the central WMI activity log, and any host that stops forwarding is identified and remediated.
Cross-framework mappings
How ISM-2129 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.15 | ISM-2129 requires WMI activity, including creation of permanent event subscriptions, to be centrally logged | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-AC-ML2.5 | ISM-2129 requires central logging of WMI activity, including creation of permanent event subscriptions | |
handshakeSupports(3)expand_less | ||
| E8-AH-ML2.14 | ISM-2129 requires WMI activity, including permanent event subscriptions, to be centrally logged | |
| E8-AC-ML3.4 | ISM-2129 requires WMI activity, including creation of permanent event subscriptions, to be centrally logged | |
| E8-AH-ML3.4 | ISM-2129 requires WMI activity, including permanent event subscriptions, to be centrally logged | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.