All Detections

WMI Permanent Event Subscription

Splunk Security@SplunkSecurity
updated 3 days ago000

Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.

Splunk (SPL)