TOKYOCORE WMI permanent event subscription for persistence

Subhankar H@Andrewsec57

•updated Jul 27, 2026•2•0•10

Detects the creation or modification of WMI event subscriptions using the wmic.exe command-line utility. Adversaries utilize WMI event subscriptions for persistence by configuring event filters, consumers, and bindings that execute malicious code upon specific system events.