value:  POSHSPY uses a WMI event subscription to establish persistence. ;; POWERTON can use WMI for persistence. ;; RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started. ;; SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup. ;; Turla has used WMI event filters and consumers to establish persistence. ;; UNC2452 used WMI event subscriptions for persistence.
name: Event Triggered Execution: Windows Management Instrumentation Event Subscription