wmi_event | Detection.FYI

Suspicious Encoded Scripts in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious Scripting in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
WMI Event Subscription

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More