wmi_event | Detection.FYI

Suspicious Scripting in a WMI Consumer

Sep 10, 2023 · attack.execution attack.t1059.005 ·
Share on:

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read More
Suspicious Encoded Scripts in a WMI Consumer

Feb 1, 2023 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
WMI Event Subscription

Oct 25, 2022 · attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More