WMI Permanent Event Subscription - Sysmon
Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.
Splunk (SPL)
Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.
Already have an account?