Home/ MITRE Matrix/ Privilege Escalation/ T1546.003

T1546.003Windows Management Instrumentation Event Subscription

T1546.003 — Windows Management Instrumentation Event Subscription is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 4 detection use cases covering it and 1 threat-intel article citing it.

Privilege EscalationPersistence

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

1Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1546 · Event Triggered Execution

Use cases covering this technique (4)

Detect WMI Event Subscription Persistence ESCU actions · alerting P Windows MOF Event Triggered Execution via WMI ESCU actions · alerting P WMI Permanent Event Subscription - Sysmon ESCU actions · alerting P Article-specific behavioural hunt — GlassWorm Hides a RAT Inside a Malicious Chrome Extension Bespoke exploit · hunting DSP

Articles citing this technique (1)

crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-458