WMI Persistence via Event Filter, Consumer, or Binding Registration

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•0

Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.