TOKYOCORE WMI Event Subscription Persistence via Win32_SystemStartup Filter
Detects the creation of WMI event filters for the Win32_SystemStartup class via wmic.exe. This technique is used by the TOKYOCORE ransomware to achieve fileless, reboot-persistent execution by triggering malicious code when specific system events occur.
Cortex XDR
