name: Sysmon EventID 21
id: 304384bc-715e-4958-988b-a8051a91349a
version: 3
date: '2025-07-10'
author: Patrick Bareiss, Splunk
description: Logs activity related to the association of a WMI event consumer with
  a filter, including details about the consumer, filter, and associated process.
mitre_components:
- WMI Creation
- Process Metadata
- Application Log Content
- OS API Execution
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
separator: EventID
separator_value: '21'
configuration: https://github.com/SwiftOnSecurity/sysmon-config
supported_TA:
- name: Splunk Add-on for Sysmon
  url: https://splunkbase.splunk.com/app/5709
  version: 5.0.0
fields:
- _time
- Channel
- Computer
- Consumer
- ConsumerNoQuotes
- EventChannel
- EventCode
- EventData_Xml
- EventDescription
- EventID
- EventRecordID
- EventType
- Filter
- FilterNoQuotes
- Guid
- Keywords
- Level
- Name
- Opcode
- Operation
- ProcessID
- RecordID
- RecordNumber
- RuleName
- SecurityID
- SystemTime
- System_Props_Xml
- Task
- ThreadID
- TimeCreated
- User
- UserID
- UtcTime
- Version
- change_type
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dvc
- dvc_nt_host
- event_id
- eventtype
- host
- id
- index
- linecount
- object
- object_attrs
- object_category
- object_path
- punct
- result
- severity_id
- signature
- signature_id
- source
- sourcetype
- splunk_server
- src
- status
- tag
- tag::eventtype
- timeendpos
- timestartpos
- user
- user_id
- user_name
- vendor_product
output_fields:
- dest
- dvc
- object
- object_attrs
- object_category
- object_path
- signature
- signature_id
- src
- status
- user
- user_id
- vendor_product
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>21</EventID><Version>3</Version><Level>4</Level><Task>21</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime='2021-06-16T21:46:50.225290200Z'/><EventRecordID>151644</EventRecordID><Correlation/><Execution
  ProcessID='1972' ThreadID='3648'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-host-14.attackrange.local</Computer><Security
  UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='EventType'>WmiBindingEvent</Data><Data
  Name='UtcTime'>2021-06-16 21:46:50.222</Data><Data Name='Operation'>Modified</Data><Data
  Name='User'>WIN-HOST-14\Administrator</Data><Data Name='Consumer'> "CommandLineEventConsumer.Name=\"Evil
  Persistence\""</Data><Data Name='Filter'> "__EventFilter.Name=\"Evil Persistence\""</Data></EventData></Event>