Skip to content
Threat Feed

Tag

Event-Subscription

1 brief RSS
medium advisory

Detect Suspicious WMI Event Subscription Creation for Persistence

This threat brief details the detection of malicious Windows Management Instrumentation (WMI) event subscriptions, a technique used by attackers for persistence and privilege escalation on Windows systems.

Elastic Defend persistence wmi windows event-subscription
2r 1t