Thomas Patzke 8ee24bf150 WMI persistence rules derived from blog article ...

https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/#so-to-summarize

2018-03-07 23:05:10 +01:00

..

builtin

WMI persistence rules derived from blog article

2018-03-07 23:05:10 +01:00

malware

Simplified rule conditions with new condition constructs

2018-03-06 23:14:43 +01:00

other

WMI persistence rules derived from blog article

2018-03-07 23:05:10 +01:00

powershell

Merged similar rules

2018-03-06 23:19:11 +01:00

sysmon

WMI persistence rules derived from blog article

2018-03-07 23:05:10 +01:00