ATT&CK ReferencesFireEye WMI 2015

FireEye WMI 2015

Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.

Techniques2

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1546.003 Windows Management Instrumentation Event Subscription	MalwareSeaDuke	SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup. FireEye WMI 2015

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.