MITRE ATT&CK technique

T1084

Windows Management Instrumentation Event Subscription

About this technique

Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.

Read the full ATT&CK description

Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)

TA0003
Curated mapping

Curated incident relationships

These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.

0 items
No curated incident mappings yet.
Heuristic association

Daily items linked through predicted CVEs

A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.

0 items
No heuristic Daily associations yet.
Heuristic association

Predicted CVE associations

These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.

0 items
No predicted associations yet for this technique.
T1084 · Windows Management Instrumentation Event Subscription · Baitaphish