Skill UI

A comprehensive guide for threat hunters and incident responders to detect WMI-based persistence mechanisms (MITRE T1546.003). It details the analysis of Sysmon Event IDs 19, 20, and 21, cross-referencing these events with root\subscription namespaces and using tools like Autoruns and SIEM analysis for robust detection.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.