Skip to content
System hardening
ASD ISMISM-2129

ASD ISM 2129 Centrally log WMI activity and event subscriptions

What it says

WMI activity, including the creation of permanent event subscriptions, is centrally logged.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

All Windows Management Instrumentation actions are tracked in a central log, including event subscriptions.

This control is about keeping a detailed record of everything that happens within Windows Management Instrumentation, or WMI. WMI is a part of Windows used by many applications and system administrators to query, configure and automate Windows hosts. Because WMI is trusted and present on every Windows system, attackers also use it, and permanent event subscriptions are a well-known persistence technique: an adversary registers a subscription that quietly runs their code whenever a chosen event occurs, surviving reboots without leaving an obvious file or scheduled task behind. By logging all WMI activity centrally, especially the creation of permanent event subscriptions, you can spot this kind of unusual or harmful behaviour even if the attacker later clears the logs on the host itself.

Why it matters

Without logging WMI activity centrally, suspicious actions like unauthorised system modifications or malware could go unnoticed. This lack of visibility increases the risk of attacks and compromises being missed, leading to potential data theft or system damage.

How to implement

  1. Configure Windows Event Forwarding to send WMI logs from all computers in the network to a central logging server.

    This helps in tracking all activities and keeping a centralised record.

  2. Ensure WMI event logging is enabled by confirming the 'Microsoft-Windows-WMI-Activity/Operational' log is turned on and capturing relevant activities.

    It is enabled by default on supported Windows versions, so enforce and verify the setting fleet-wide through Group Policy, wevtutil or your configuration management tooling rather than adjusting each machine by hand.

  3. Set up alerts in your logging system for specific WMI tasks that might indicate malicious intent, such as creating new event subscriptions without proper authorisation.

  4. Use tools like PowerShell to regularly audit existing WMI event subscriptions on each machine to ensure they match expected configurations.

    This can help identify any unauthorised changes.

  5. Reconcile the list of Windows hosts reporting WMI activity to the central logging server against your asset inventory, and investigate and fix any host that has stopped forwarding so that central logging remains complete.

Keep it running

Regularly review WMI logs to identify any unusual activity patterns or new permanent event subscriptions. Update alert conditions in line with emerging threats or changes in the IT environment. Ensure that all systems are consistently configured to log and forward WMI activity to prevent gaps in monitoring. Also, refresh and test audit processes to confirm they remain effective and responsive to new WMI behaviour and system updates.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Request the configuration settings for Windows Event Forwarding used to centralise WMI logs.

    Look at

    Check that the forwarding settings include all necessary endpoints and that logs are being sent to a central server.

    Good evidence

    A properly configured system where logs from all endpoints are being forwarded and received by the central server.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for evidence of enabled WMI logging, specifically the Microsoft-Windows-WMI-Activity/Operational log settings.

    Look at

    Verify that the operational log for WMI activity is enabled and collecting the appropriate level of detail.

    Good evidence

    Logging is enabled with settings that capture all important WMI activities, including event subscriptions.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Request documentation on WMI-related alerts set up in the central logging system.

    Look at

    Examine the list of alerts to ensure they cover critical activities like unauthorised WMI event subscriptions.

    Good evidence

    A comprehensive set of alerts that correctly flags potentially suspicious WMI activities.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for recent audit reports of WMI event subscriptions.

    Look at

    Look for discrepancies between the current state of event subscriptions and the expected configurations.

    Good evidence

    Audit reports show that all WMI event subscriptions are known and authorised, with no unexpected configurations.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Request a comparison of the Windows hosts reporting WMI activity to the central logging server against the asset inventory.

    Look at

    Check for in-scope Windows hosts that are missing from the central log or have stopped forwarding, and how such gaps are detected and resolved.

    Good evidence

    Every in-scope Windows host is represented in the central WMI activity log, and any host that stops forwarding is identified and remediated.

Mappings

Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.15Logging of activities and eventsPartially meets
Essential Eight

ASD Essential Eight: 3 mappings

  • E8-AC-ML3.4Event logs from non-internet-facing servers are analysedSupports
  • E8-AH-ML2.14Timely analysis of event logs from internet-facing serversSupports
  • E8-AH-ML3.4Analyse event logs from non-internet-facing servers for cyber threatsSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.