WMI Event Subscription Persistence via wmic.exe or scrcons.exe

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•4

Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.