WMI Persistence - Command Line Event Consumer
Detects the loading of 'wbemcons.dll' by 'WmiPrvSE.exe', which is indicative of a WMI command line event consumer being used for persistence. This technique is often leveraged by adversaries to maintain access and execute code when specific WMI events occur.
Sigma
