Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
Forums
Main Category
General (Technical,...
Investigating WMI P...
 
Notifications
Clear all

Investigating WMI Permanent Event Subscription Persistence

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by Zoe 1 hour ago
1 Posts
1 Users
0 Reactions
12 Views
RSS
Zoe
 Zoe
(@zoe)
Moderator
Joined: 5 years ago
Posts: 233
Topic starter 19/10/2026 3:49 pm   [#20813]

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup.

Read the full article here: https://www.forensicfocus.com/articles/investigating-wmi-permanent-event-subscription-persistence/  



   
Quote
Topic Tags
windows forensics
Forum Jump:
  Previous Topic
Related Topics
Topic Tags:  windows forensics (2) ,
Share: