Wmi Event Subscription Persistence

WMI Event Subscription Persistence — CONSOLIDATED

⚠️ This skill has been consolidated. The canonical, comprehensive version is: red-teaming/persistence/wmi-event-subscriptions

That skill includes:

• 4 trigger types (startup, user logon, process launch, time-based)
• 2 consumer types (CommandLineEventConsumer, ActiveScriptEventConsumer)
• Full OPSEC guidance and cleanup procedures
• Comprehensive Blue Team detection via Sysmon Event IDs 19/20/21
• Decision flowchart for choosing the right approach

When to Use

Use wmi-event-subscriptions instead of this skill. This entry exists for backward compatibility.

Prerequisites

• See the wmi-event-subscriptions skill for full prerequisites

Workflow

Phase 1: Redirect to Canonical Skill

Refer to red-teaming/persistence/wmi-event-subscriptions for the complete workflow.

Key Concepts

Proof of Concept (PoC)

# Standard payload injection format
curl -X POST https://target/api -d 'exploit=true'

🔵 Blue Team

• Deploy robust WAF rules to detect anomalies.
• Monitor logs for unusual access patterns.

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• See red-teaming/persistence/wmi-event-subscriptions for all references

• Mitre ATT&CK Reference