Dragon Boss WMI Persistence
Detects the creation of WMI event consumers associated with the Dragon Boss AV killer, specifically looking for names containing 'MbRemovalMbSetupKillConsumer'. This mechanism is actively used by this campaign to ensure immediate termination of AV setup processes upon system boot.
Sigma
