Event ID 5858ErrorMicrosoft-Windows-WMI-Activity/OperationalT1546.003

Windows Event ID 5858 — WMI Provider Error

Logged when a WMI provider operation fails. Contains the provider name, error code, and the initiating process — useful for detecting failed WMI execution attempts and probing activity.

MITRE ATT&CK

Technique

T1546.003 · Windows Management Instrumentation Event Subscription

Tactic

Persistence

View on attack.mitre.org →

Why It Matters

Attackers probing WMI capabilities or using malformed subscriptions generate 5858 errors before successful exploitation. A burst of 5858 events from an unexpected process or user is a reconnaissance signal. 5858 also helps identify failed WMI lateral movement attempts (Invoke-WmiMethod, wmiexec) where the attacker's command did not fully execute.

Key Fields

ProviderNameThe provider that failed — look for repeated failures targeting root\subscription or specific providers
CodeThe WMI error code — WBEM_E_ACCESS_DENIED (0x80041003) suggests privilege issues; WBEM_E_NOT_FOUND (0x80041002) may indicate probing for specific classes
HostProcessThe process that triggered the failure — unexpected hosts (PowerShell, cmd) generating WMI errors are suspicious

Investigation Tips

  1. 1.Multiple 5858 errors from powershell.exe or an unexpected host process indicate WMI probing or a failed lateral movement attempt via Invoke-WmiMethod or wmiexec.
  2. 2.WBEM_E_ACCESS_DENIED errors from a non-admin process can indicate an attacker attempting WMI operations without sufficient rights — check what account triggered them.
  3. 3.Correlate 5858 errors with 5857 successes — attackers often generate errors while establishing WMI subscriptions, then succeed on a later attempt.
  4. 4.Is this always malicious? No — WMI errors occur frequently due to misconfigured management software, network timeouts, and permission issues. Focus on unexpected source processes and repeated errors targeting the subscription namespace.

Go deeper: the full WMI Persistence — Event Subscription Backdoors guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the WMI Persistence — Event Subscription Backdoors guide →

See Event ID 5858 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →