WMI Persistence

On Windows, adversaries can use a permanent WMI event subscription—an event filter, an event consumer, and a binding in the WMI repository—to trigger content when a specified event occurs, such as a logon, time or uptime event, or process-related event. Depending on the consumer and execution context, this can provide persistence and may support privilege escalation. A reviewed MOF file can register the same subscription objects.