WMI Event Subscription Persistence

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•3

Detects the creation of WMI event subscriptions, which can be used by adversaries for persistence. The rule specifically looks for command-line arguments related to WMI namespace manipulation or PowerShell cmdlets for WMI event creation.