Use a powershell to install a WMI event subscription persistence mechanism. This technique requires setting the #{staging_dir} fact to specify the path the Pneuma agent.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.