CmdID

CmdID / Techniques / T1546

T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1546.003 on attack.mitre.org

Part of

MITRE ATT&CK
T1546Event Triggered Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalWMI Backdoor Exchange Transport AgentFlorian Roth (Nextron Systems) · Windows
highNewActiveScriptEventConsumer Creation Attempt via Wmic.EXEFlorian Roth (Nextron Systems) · Windows
mediumWMI Persistence - Script Event ConsumerThomas Patzke · Windows