WMI event subscriptions are a favourite persistence trick because they blend into normal Windows activity. Here is how to root them out using Sysmon, the ELK stack, and osquery together.
nesrine cherrabi
THREAT HUNTER
WMI event subscriptions are a favourite persistence trick because they blend into normal Windows activity. Here is how to root them out using Sysmon, the ELK stack, and osquery together.