detecting-wmi-persistence
mukul975/Anthropic-Cybersecurity-Skills
Detect WMI subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious filters, consumers, and bindings, enabling threat hunters to validate telemetry, prioritize follow-up, and remediate attacker persistence.
