Skip to content

Hide Navigation Hide TOC

WMI Persistence - Security (f033f3f3-fd24-4995-97d8-a3bb17550a88)

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Cluster A Galaxy A Cluster B Galaxy B Level
WMI Persistence - Security (f033f3f3-fd24-4995-97d8-a3bb17550a88) Sigma-Rules Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 2