Install WMI event subscription

/static/assets/windows-logo.svg
This procedure installs a WMI event subscription as persistence mechanism which will execute the Pneuma agent when Notepad is launched.
locked
View Command

You must be logged in to view this TTPs command.

Login

Test this TTP

Download Operator (1.7.0)