← DFIR

WMI Malware

Cyber Triage article on malware that abuses WMI.

Covers how attackers use Windows Management Instrumentation for execution, persistence and lateral movement, and where defenders can find the traces such as repository files and event logs.

Why it's useful

Understand a persistence method that hides well.