Skip to content

Hide Navigation Hide TOC

Powershell WMI Persistence (9e07f6e7-83aa-45c6-998e-0af26efd0a85)

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Cluster A Galaxy A Cluster B Galaxy B Level
Powershell WMI Persistence (9e07f6e7-83aa-45c6-998e-0af26efd0a85) Sigma-Rules Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 2