WMI Permanent Event Subscription via wmic.exe or mofcomp.exe

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects potential persistence attempts via WMI event subscriptions. The rule monitors for the creation of WMI event consumers using 'wmic.exe' with suspicious command line arguments, or the use of 'mofcomp.exe' to compile MOF files by non-standard, non-Microsoft signed processes.