domains / families / security / hunting-for-persistence-via-wmi-subscriptions

hunting-for-persistence-via-wmi-subscriptions

separate

Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003)

When to use

• When proactively searching for fileless persistence mechanisms in Windows environments
• After threat intelligence reports indicate WMI-based persistence by APT groups (APT29, APT32, FIN8)
• When investigating systems where malware persists across reboots despite cleanup attempts
• During incident response when standard persistence locations (Run keys, scheduled tasks) are clean
• When WmiPrvSe.exe is observed spawning unexpected child processes

Skill page

Source