skills.homes logoskills.homescapability registry
home/categories/computational-chemistry/mukul975-anthropic-cybersecurity-skills-skills-detecting-wmi-persistence-skill-md
cd ..
computational-chemistryresearch

detecting-wmi-persistence

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

View Sourcecomputational-chemistry
mukul975
maintainer
mukul975
Updated 4/6/2026
Stars
4240
Forks
464
quick start

Installation and usage

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

Installation
$ install --globalskills.sh
Usage

Once installed, you can use this skill by running the following command in your terminal:

skills use detecting-wmi-persistence