Block persistence through WMI event subscription
This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\e6db77e5-3df2-4cf1-b95a-636979351e5b
This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a DWORD value, and value data 1 places the rule in block mode.
The rule blocks activity detected as an attempt to establish persistence through a WMI event subscription. Such subscriptions can be stored in the WMI repository and cause code to run automatically when specified events occur. Attackers use this mechanism for fileless persistence because it does not require a conventional startup entry and might not leave an obvious executable file on disk.
The rule does not disable WMI as a whole. It targets Defender-detected abuse of the WMI event model for persistence.
Notes
Additional effects
When the rule blocks an action, Microsoft Defender can generate a local user notification and, on connected devices, an EDR alert. The associated advanced hunting action types are AsrPersistenceThroughWmiBlocked and, for a different rule mode, AsrPersistenceThroughWmiAudited.
Security
Block mode makes it harder for malware to establish durable, event-triggered execution through permanent WMI event subscriptions. It therefore restricts a specific technique used for covert and fileless persistence.
The rule does not prevent other persistence techniques or every malicious use of WMI. Its protection is limited to activity detected by this ASR rule.
Possible side effects
The rule can affect legitimate management or monitoring software that relies on WMI event subscriptions. Microsoft specifically notes that the Microsoft Configuration Manager client depends heavily on WMI. This rule also has limited support for file and folder exclusions.
Notes
The rule depends on Microsoft Defender Antivirus and RPC. Microsoft documents support for Windows 11, Windows 10 version 1903 and later, and supported Windows Server releases starting with Windows Server 1903 (Semi-Annual Channel). The rule is not supported on Windows Server 2012 R2 or Windows Server 2016.
Microsoft documentation
Microsoft Learn: ASR rules reference – Block persistence through WMI event subscription
Microsoft Learn: Policy CSP – Defender – AttackSurfaceReductionRules