WMI Persistence - Security Event 4662
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. This rule specifically looks for Event ID 4662, indicating an operation on an object, where the ObjectType is 'WMI Namespace' and the ObjectName contains 'subscription'. This combination is indicative of WMI persistence mechanisms being created or modified.
Sigma
