Event Triggered Execution: Windows Management Instrumentation Event Subscription

adbupd can use a WMI script to achieve persistence.^[6]

APT29 has used WMI event subscriptions for persistence.^[7]

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.^[8]

BADHATCH can use WMI event subscriptions for persistence.^[9]

Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.^[10]

FIN8 has used WMI event subscriptions for persistence.^[11]

HEXANE has used WMI event subscriptions for persistence.^[12]

HOPLIGHT can use WMI event subscriptions to create persistence.^[13]

Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.^[12]

Leviathan has used WMI for persistence.^[14]

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as cdb.exe.^[15]

metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.^[15]

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.^[16]

During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.^[17]

PoshC2 has the ability to persist on a system using WMI events.^[18]

POSHSPY uses a WMI event subscription to establish persistence.^[19]

POWERTON can use WMI for persistence.^[20]

Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.^[21]

RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.^[17]

Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.^[22]

SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.^[3]

SILENTTRINITY can create a WMI Event to execute a payload for persistence.^[23]

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with rundll32.exe.^[24][25]

TrailBlazer has the ability to use WMI for persistence.^[26]

Turla has used WMI event filters and consumers to establish persistence.^[27]

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent malware from abusing WMI to attain persistence.^[28]

Prevent credential overlap across systems of administrator and privileged accounts.^[3]

By default, only administrators are allowed to connect remotely using WMI; restrict other users that are allowed to connect, or disallow all users from connecting remotely to WMI.