Event ID 19
WMI event filter is registeredSource:
Microsoft-Windows-Sysmon
Category:
WmiEventFilter activity detected
WmiEventFilter activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! EventNamespace: %6!s! Name: %7!s! Query: %8!s!
When a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.
LEFT/RIGHT arrow keys for navigation
Back to List