WMI Event Subscription Persistence via wmic, PowerShell, or mofcomp

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.