All Detections

Codex - WMI Event Subscription Persistence (T1546.003)

avatar
Ibrahim Saud@tektrix
updated Jun 22, 2026103

Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.

Microsoft Sentinel (KQL)