WMI

WMI Event Consumers: what are you missing?

Main area: Detection Engineering · 768 words · 4 min read

Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.

• DFIR
• WMI
• Detection
• Velociraptor

Blue Team Hacks - Binary Rename

Main area: Detection Engineering · 1,009 words · 5 min read

Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.

• DFIR
• WMI
• Detection

Blue Team Hacks - WMI Eventing

Main area: Detection Engineering · 1,139 words · 6 min read

Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.

• DFIR
• PowerShell
• WMI
• Detection