A hunt enumerated existing WMI subscriptions estate-wide; the promoted rule watches creation events. What coverage was lost?

## Two different questions that share a name When a hunter says "I looked for WMI persistence", they may mean either of two things, and the difference decides what a promoted rule actually covers. - A **state sweep** asks: *what subscriptions exist on these hosts right now?* It is answered by querying live hosts or by a fleet query tool that reads the current contents of the `root\subscription` namespace. It sees whatever is there, however old. - An **event rule** asks: *when is a subscription created?* It is answered from telemetry — Sysmon's WMI records — and it sees only changes that happened while telemetry was flowing. Hunts often start as state sweeps because that is the natural way to find something for the first time. Rules are almost always event rules, because that is what a detection platform evaluates. Promotion therefore silently changes the question, and the change is easy to miss precisely because the output looks similar. ## What the event rule cannot see **The existing backlog.** Every subscription already registered when the rule goes live produced its creation record in the past — or produced none at all — so the rule will never fire on it. This includes the very finding that motivated the promotion. If a hunter found a hostile binding by hand on Tuesday and you deploy the rule on Friday, that binding is not covered by your new detection; only the next one is. **Anything planted before telemetry.** The rule's reach per host starts at that host's telemetry start, not at the estate's age. A staged Sysmon rollout, hosts rebuilt from an old image, or a machine that spent months out of the collector's reach all carve holes that no amount of runtime closes. **Telemetry gaps.** If an agent stopped reporting for a week and a subscription was created in that week, the event view has nothing. A later state sweep would still find the object sitting there. ## What the state sweep cannot see It is worth being even-handed, because the honest answer is that neither view subsumes the other. **Short-lived subscriptions.** An adversary who registers a subscription, uses it and deletes it leaves nothing for a sweep to find. The event view captures the whole arc, because deletions are recorded too — Sysmon's WMI records carry an `Operation` field with `Created` and `Deleted` values. A create-then-delete pair on the same consumer name within minutes is a stronger signal than most state findings. **Provenance.** A sweep tells you a subscription exists. The event records tell you *when* it appeared and under which account, which is what makes it correlatable with a logon, a deployment window, or a session you already suspect. **Hosts that are down or unreachable at sweep time.** A sweep is a point-in-time census and it misses whatever was asleep. ## What promotion should actually deliver The defensible promotion is a pair: 1. **The event rule**, anchored on the binding record, narrowed to the claim you can defend, with its threshold, owner and triage notes — covering everything from now on. 2. **A recurring state sweep**, on a stated cadence, covering the backlog and any host whose telemetry lapsed. This is not an alert; it is a scheduled review that produces a small list somebody reads. Its cadence is a capacity decision, and monthly or quarterly is far better than never. Plus, at promotion time, a **one-off retrospective pass**: run the state sweep across the estate once, deliberately, so the backlog is dealt with rather than left as a permanent blind spot behind a rule everyone assumes covers it. ## Why this matters more than it sounds The failure is not that a rule misses something — every rule misses something. The failure is a **coverage claim that is wrong in a specific and confident way**. The team believes the technique is now watched. In fact only future instances are watched, the population most likely to matter (anything an adversary already established) is exempt, and nobody will discover this until an incident finds an old subscription the rule never mentioned. The general form of the lesson goes well beyond WMI. Whenever you promote a hunt into a rule, ask which question the hunt answered and which question the rule answers. If the hunt asked *what is* and the rule asks *what happens next*, you have changed the coverage, and the difference is a backlog that needs its own treatment.