win:wmi
WMI Activity log
Channel: Microsoft-Windows-WMI-Activity/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 6
- Rules listed
- 3
- Events
- 5
Techniques
Rules
Splunk 1
Sigma 2
- Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog by Swachchhanda Shrawan Poudel (Nextron Systems)
- WMI Persistence by Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community