Skip to content

Hide Navigation Hide TOC

Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation - DET0086 (99e60eb7-f2fa-4423-8c51-29832cd6e7ef)

None

Cluster A Galaxy A Cluster B Galaxy B Level
Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation - DET0086 (99e60eb7-f2fa-4423-8c51-29832cd6e7ef) Detection Strategies 1
Analytic 0236 - AN0236 (1a0640f0-e286-405f-9ab3-507c1abb77da) Analytics Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation - DET0086 (99e60eb7-f2fa-4423-8c51-29832cd6e7ef) Detection Strategies 1
Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern 2