Groups like Cozy Bear (APT29), Turla, and FIN8 have used WMI event subscriptions as a persistence mechanism for years, and it remains one of the most effective techniques in their playbook precisely because most defenders don't know to look for it. APT29's POSHSPY backdoor, for example, uses WMI for persistence while executing a PowerShell payload that survives every reboot. In this room, you will learn about WMI and how to investigate WMI persistence.

Learning Objectives

• Understand what WMI is and how its event subscription model works.
• Understand how attackers abuse WMI event subscriptions for persistence.
• Detect WMI persistence artefacts using event log analysis.
• Detect WMI persistence artefacts using DFIR analysis.
• Mitigate WMI-based persistence in Windows environments.

Prerequisites

Before starting this room, you should be familiar with the following TryHackMe rooms:

• Windows Forensics 1
• Windows Forensics 2
• Windows Logging for SOC
• Windows Event Logs

Lab Access

Before moving forward, let's get your lab set up. You can start and access the lab machine from the browser. If you are using your own machine, connect to the TryHackMe network using the OpenVPN configuration file from your account settings, then RDP into the lab machine using the credentials below. Accept the certificate when prompted, and you should be logged into the remote system.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine

Once connected to the machine, all the tools will be in the folder C:\Users\DFIRUser\DFIR Tools.