PersistencewindowsPro
WMI event subscriptions
A filter, a consumer and a binding together make persistence that touches no autostart key and no task folder, survives reboot, and runs as SYSTEM. It is quiet, and it is missed by anyone checking only the usual places.
What members see here
- Every path this artifact lives at, and which builds each applies to.
- What it proves, and what it does not prove, which is the part that matters.
- How to parse it, and the tooling that reads it correctly.
- Hunting queries for Splunk, Sentinel and Elastic, with their false-positive notes.