# T1546.003 Windows Management Instrumentation Event Subscription > As of 2026-10-31, T1546.003 (Windows Management Instrumentation Event Subscription) appears in 10 tracked threats, first reported 2026-02-19 and most recently 2026-10-30, with linked actors including Aurora ransomware affiliate, GTG-50014; it most often appears alongside T1053.005 (Scheduled Task). - **Tracked threats:** 10 (4 high, 6 medium) - **First seen:** 2026-02-19 - **Last seen:** 2026-10-30 - **Threat actors:** 2 - **Detection rules:** 22 (counts only; Blue tier and above) ## Key facts - **ID:** T1546.003 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence, Privilege Escalation - **Matrix:** Enterprise - **Parent:** T1546 - **Data as of:** 2026-10-31 - **MITRE:** https://attack.mitre.org/techniques/T1546/003/ ## Activity timeline T1546.003 first appeared in tracked threats on 2026-02-19 and was most recently reported on 2026-10-30. The busiest month was 2026-09 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1546.003 Windows Management Instrumentation Event Subscription is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of [T1546 Event Triggered Execution](https://intel.threadlinqs.com/technique/T1546). Threadlinqs maps 10 of 3416 tracked threats (0.3%) to it; by severity that is 4 high, 6 medium. Threats that use T1546.003 most often also use [T1053.005 Scheduled Task](https://intel.threadlinqs.com/technique/T1053.005) (8 threats), [T1547.001 Registry Run Keys / Startup Folder](https://intel.threadlinqs.com/technique/T1547.001) (7 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (7 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (6 threats), [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1546.003; the most frequent are [Aurora ransomware affiliate](https://intel.threadlinqs.com/actor/Aurora%20ransomware%20affiliate) (1), [GTG-50014](https://intel.threadlinqs.com/actor/GTG-50014) (1). ## Threat actors using it - [Aurora ransomware affiliate](https://intel.threadlinqs.com/actor/Aurora%20ransomware%20affiliate) — 1 - [GTG-50014](https://intel.threadlinqs.com/actor/GTG-50014) — 1 ## Tracked threats 10 tracked threats use T1546.003. - [Hermes Stealer: Russian-Market Malware-as-a-Service Platform and PyMapper Distribution Chain](https://intel.threadlinqs.com/threat/TL-2026-4815) — medium — 2026-10-30 - [AI-Enabled Ransomware and Extortion Economics: Stolen AI Credentials, Aurora Ransomware and GTG-50014…](https://intel.threadlinqs.com/threat/TL-2026-4475) — high — 2026-10-26 - [CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)](https://intel.threadlinqs.com/threat/TL-2026-2753) — medium — 2026-09-22 - [ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel](https://intel.threadlinqs.com/threat/TL-2026-2621) — medium — 2026-09-22 - [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…](https://intel.threadlinqs.com/threat/TL-2026-2615) — medium — 2026-09-22 - [PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…](https://intel.threadlinqs.com/threat/TL-2026-2593) — medium — 2026-09-20 - [Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actors](https://intel.threadlinqs.com/threat/TL-2026-2008) — high — 2026-08-13 - [Gemini CLI Abused as Autonomous AI Hacking Agent to Build and Operate "Patriot Bait" (bandcampro) C2 Botnet…](https://intel.threadlinqs.com/threat/TL-2026-1394) — medium — 2026-07-16 - ["Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaign](https://intel.threadlinqs.com/threat/TL-2026-1356) — high — 2026-07-15 - [CVE-2026-20841: Command Injection in Windows Notepad Markdown Link Handling Enables Arbitrary Code Execution](https://intel.threadlinqs.com/threat/TL-2026-1549) — high — 2026-02-19 ## Related CVEs CVEs referenced by the tracked threats that use T1546.003, most frequent first. - [CVE-2020-14979](https://intel.threadlinqs.com/cve/CVE-2020-14979) - [CVE-2026-20841](https://intel.threadlinqs.com/cve/CVE-2026-20841) ## Detection coverage Threadlinqs maintains 22 detection rules mapped to T1546.003 (SPL 8, KQL 6, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only. 22 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1546 Event Triggered Execution](https://intel.threadlinqs.com/technique/T1546) — 150 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1546.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)