WMI Persistence - Script Event Consumer File Write (33f41cdd-35ac-4ba8-814b-c6a4244a1ad4)

Detects file writes of WMI script event consumer

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
WMI Persistence - Script Event Consumer File Write (33f41cdd-35ac-4ba8-814b-c6a4244a1ad4)	Sigma-Rules	Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58)	Attack Pattern	1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db)	Attack Pattern	Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58)	Attack Pattern	2