Research

Guided lab: the persistence that leaves almost no log

WMI event subscriptions run code on a condition you choose, survive reboots, live nowhere in the filesystem, and log nothing by default. The last of the persistence series, and the one that changes how you think about the other three.

Full write-up available to members subscribers. See what is included.