ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1546.003×

13 examples

Technique	Used by	Procedure example
T1546.003 Windows Management Instrumentation Event Subscription	MalwareSardonic	Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence. Bitdefender Sardonic Aug 2021
T1546.003 Windows Management Instrumentation Event Subscription	Malwareadbupd	adbupd can use a WMI script to achieve persistence. Microsoft PLATINUM April 2016
T1546.003 Windows Management Instrumentation Event Subscription	MalwareBADHATCH	BADHATCH can use WMI event subscriptions for persistence. BitDefender BADHATCH Mar 2021
T1546.003 Windows Management Instrumentation Event Subscription	MalwareHOPLIGHT	HOPLIGHT can use WMI event subscriptions to create persistence. US-CERT HOPLIGHT Apr 2019
T1546.003 Windows Management Instrumentation Event Subscription	MalwareRegDuke	RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started. ESET Dukes October 2019
T1546.003 Windows Management Instrumentation Event Subscription	MalwarePOSHSPY	POSHSPY uses a WMI event subscription to establish persistence. FireEye POSHSPY April 2017
T1546.003 Windows Management Instrumentation Event Subscription	MalwareSeaDuke	SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup. FireEye WMI 2015
T1546.003 Windows Management Instrumentation Event Subscription	MalwareTrailBlazer	TrailBlazer has the ability to use WMI for persistence. CrowdStrike StellarParticle January 2022
T1546.003 Windows Management Instrumentation Event Subscription	MalwaremetaMain	metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence. SentinelLabs Metador Sept 2022
T1546.003 Windows Management Instrumentation Event Subscription	MalwareKevin	Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware. Kaspersky Lyceum October 2021
T1546.003 Windows Management Instrumentation Event Subscription	MalwarePOWERTON	POWERTON can use WMI for persistence. FireEye APT33 Guardrail
T1546.003 Windows Management Instrumentation Event Subscription	ToolSILENTTRINITY	SILENTTRINITY can create a WMI Event to execute a payload for persistence. GitHub SILENTTRINITY Modules July 2019
T1546.003 Windows Management Instrumentation Event Subscription	ToolPoshC2	PoshC2 has the ability to persist on a system using WMI events. GitHub PoshC2

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.