Getting Started with WMI Weaponization – Part 6

Explains WMI event-driven persistence through filter, consumer, and binding triples, contrasting polled intrinsic events with push-based extrinsic events for launching commands on user logon.

Teaches enumerating the 1,500-plus WMI classes on a system with Get-CimClass, then dissecting properties and methods of classes like Win32_Process to find attacker-useful functionality.

Shows how stolen Exchange credentials can be weaponized through malicious Outlook rules that sync via Exchange and trigger a Start Application action, executing payloads without workstation access.

With the extensions/write permission, an attacker can deploy the Salt Minion extension pointed at a rogue Salt Master and push arbitrary states to an Azure VM as root over ZeroMQ ports 4505/4506.

With extensions/write, an attacker can point the Chef extension at a rogue Chef server for stealthy command execution and persistence on Azure VMs disguised as routine configuration management.

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.