WMI Malicious Consumer Subscription (CommandLine/ActiveScript)

Arnold Chan@slaz

•updated 28 days ago•1•0•2

Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.