---
id: 8168
title: "Getting Started with WMI Weaponization – Part 5"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-5/"
published_at: "2017-04-18T00:00:00Z"
tags: ["windows", "powershell", "wmi", "persistence", "event-triggers"]
phying_url: "https://phying.com/item/8168"
lang: en
---

# Getting Started with WMI Weaponization – Part 5

## Summary

Explains WMI event-driven persistence through filter, consumer, and binding triples, contrasting polled intrinsic events with push-based extrinsic events for launching commands on user logon.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2017-04-18T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-5/
- **Phying News:** https://phying.com/item/8168