Removing Fileless Malware Hidden In WMI Event Subscriptions

Fileless malware can remain active without leaving a conventional executable on disk. A common persistence method abuses Windows Management Instrumentation (WMI) event subscriptions, allowing malicious PowerShell or script code to launch when a system event occurs, such as logon, startup, or a scheduled interval. Learn more about Step By Step Cleanup Of Malware That Uses Windows Image Acquisition To Access Your Camera Adca27.

This threat is difficult to spot because the payload may be stored inside WMI’s repository while the action is triggered by a consumer and filter combination. Security software may detect suspicious behaviour rather than a clearly named program, and a normal reboot will not necessarily remove the persistence.

The steps below are designed for Windows users in Australia, including people working from home in Sydney, Melbourne, Brisbane, Perth, Adelaide, or regional areas. Use an administrator account, avoid deleting unfamiliar objects at random, and preserve useful evidence before making changes.

Recognising WMI-Based Fileless Activity

Warning signs can include PowerShell opening briefly at logon, unexplained network connections, repeated Defender alerts, or high CPU usage shortly after startup. You may also see unusual child processes such as powershell.exe, wscript.exe, mshta.exe, or rundll32.exe launched by a service or system process.

Check whether the behaviour returns after restarting Windows. A subscription-based infection often reappears when its trigger fires, while a one-time script may disappear. Review Windows Security’s protection history, Event Viewer, and recent account activity before changing the WMI repository.

Isolating The Affected Computer

Disconnect the computer from Wi-Fi or Ethernet if you suspect active data theft, remote control, or credential harvesting. This is especially important for a home office connected to a business VPN, a small retail network, or a shared household router. Do not log into banking, myGov, email, or cryptocurrency accounts from the suspected device.

Use a separate trusted device to change important passwords, enable multifactor authentication, and contact your employer’s IT team if the computer contains work data. Australian organisations may need to follow internal incident procedures, and businesses should consider whether a report to the Australian Cyber Security Centre is appropriate.

Recording Suspicious WMI Entries

Open Windows Terminal or PowerShell as administrator and list permanent event subscriptions with these commands:

Get-CimInstance -Namespace root\subscription -ClassName __EventFilter
Get-CimInstance -Namespace root\subscription -ClassName CommandLineEventConsumer
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding

Look for consumers containing encoded PowerShell, long Base64 strings, URLs, temporary folders, unusual user profiles, or commands that bypass normal security controls. Legitimate management software can create WMI entries, so record each object’s name, creator, command, and creation time rather than assuming every unfamiliar entry is malicious.

Exporting Evidence Before Removal

Capture the output to text files so you can compare it with security logs or provide it to a technician. For example:

$folder = "$env:USERPROFILE\Desktop\WMI-evidence"
New-Item -ItemType Directory -Path $folder -Force
Get-CimInstance -Namespace root\subscription -ClassName __EventFilter |
  Out-File "$folder\filters.txt"
Get-CimInstance -Namespace root\subscription -ClassName CommandLineEventConsumer |
  Out-File "$folder\consumers.txt"
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding |
  Out-File "$folder\bindings.txt"

Save the files to an external drive only after scanning that drive, and avoid copying suspicious scripts for casual opening. If the infection involves camera access or image capture, follow this camera access cleanup guide alongside the WMI investigation.

Removing The Malicious Subscription

Use the object names and paths identified during inspection to remove only confirmed malicious entries. CIM deletion can be performed with commands similar to these:

Get-CimInstance -Namespace root\subscription -ClassName __EventFilter -Filter "Name='SuspiciousFilter'" |
  Remove-CimInstance

Get-CimInstance -Namespace root\subscription -ClassName CommandLineEventConsumer -Filter "Name='SuspiciousConsumer'" |
  Remove-CimInstance

Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding |
  Where-Object { $_.Filter -like '*SuspiciousFilter*' -or $_.Consumer -like '*SuspiciousConsumer*' } |
  Remove-CimInstance

Replace the example names with the exact malicious object names. Remove the binding first when possible, followed by the consumer and filter. If PowerShell reports access errors, restart in Safe Mode with Networking only when necessary, then repeat the inspection carefully.

Scanning For The Payload And Related Changes

Deleting the WMI trigger may stop execution, but it does not guarantee that every related file or account change is gone. Run Microsoft Defender Offline scan from Windows Security, followed by a full scan. Keep security definitions current, and use a reputable second-opinion scanner if the alerts continue.

Inspect common persistence locations, including Task Scheduler, startup folders, services, Run and RunOnce registry keys, browser extensions, and unusual local administrator accounts. If you need broader Windows-specific removal procedures, the Windows malware guides provide additional coverage for trojans, spyware, hijackers, and ransomware.

Evidence And Hardening Checks

Before restarting, confirm that the suspicious filter, consumer, and binding no longer appear. Then restart and monitor PowerShell, Defender, and network activity. Windows Event Viewer can help identify whether the same trigger returns.

Keep the following evidence where it cannot be overwritten:

• WMI query output and object names
• Defender detection history
• Relevant Event Viewer exports
• Suspicious commands, domains, and timestamps

After the system is clean, apply updates and reduce future exposure:

• Enable tamper protection and real-time protection
• Remove unused local administrator accounts
• Block unnecessary PowerShell scripting through managed policy
• Back up important files using an offline or versioned destination

Checking Recovery And Ongoing Protection

If the machine remains unstable, restore from a trusted backup made before the suspected compromise, or reinstall Windows using official Microsoft media. Do not restore unknown executables, cracked software, or unverified browser extensions. A clean installation is often safer for a computer used for payroll, client records, or business administration.

Australian users should also check modem and router firmware, especially after a compromise on a home network. Change the router administrator password, review connected devices, and update Wi-Fi security settings. Regular offline backups, prompt patching, and cautious handling of email attachments provide stronger protection against a WMI persistence mechanism returning.