Skip to content
.evtx

Posts tagged "{tag}": #wmi

← ← Back to blog
WMI event-subscription persistence in the event logs
How attackers persist with permanent WMI event subscriptions (__EventFilter + __EventConsumer + __FilterToConsumerBinding) and what the WMI-Activity Operational log records — Event ID 5861 and friends.
evtxdfirpersistencewmi