Skip to content
WMIparser

Posts tagged: #incident-response

← Back to all posts
WMI Persistence Investigation Checklist
Step-by-step checklist for WMI persistence: live queries, the repository, event IDs 5860 and 5861, Sysmon 19-21, execution evidence and a safe clean-up.
wmiincident-responseevent-logspersistence