cd ../projects

WMIPersist

Permanent WMI event subscription persistence — browser process creation triggers payload execution, machine-unique naming, .NET Framework 2.0, two source files.

active
c#windowspersistencewmi

Run keys get hunted. Scheduled tasks get baselined. WMI event subscriptions sit in a different layer — permanent, reboot-surviving, and often missed because building them correctly means wiring three separate objects in root\subscription by hand.

WMIPersist creates that subscription in two source files targeting .NET Framework 2.0. An __EventFilter watches Win32_Process creation for major browsers — Chrome, Edge, Firefox, Opera, Vivaldi. A CommandLineEventConsumer holds the payload path and arguments. An __FilterToConsumerBinding links them. Subscription names derive from the machine GUID, same collision-avoidance pattern as the Task Scheduler sibling.

Execution is browser-triggered: the payload fires when a monitored process starts, not at boot or logon. That changes the detection profile and the operator workflow — persistence waits for user activity instead of announcing itself at session start. Registration requires elevation to write under root\subscription; after that the subscription persists until all three WMI objects are manually removed.

Minimal footprint, no third-party dependencies, and a static constructor entry point for COM-visible or InstallUtil-style loading. The kind of persistence primitive you want in a toolkit when the engagement brief says “survive reboot, stay quiet, don’t look like a textbook sample.”

Built for authorized red team operations, penetration testing, and security research with written permission.

cat redacted-results.log sanitized logs

Subscription registration

redacted creation log

Three WMI objects in root\subscription — filter, consumer, and binding — named from the host machine GUID.

sanitized-output
namespace: root\subscription
name: _[REDACTED]
filter:
  query: SELECT * FROM __InstanceCreationEvent
         WITHIN 5 WHERE TargetInstance ISA 'Win32_Process'
         AND (TargetInstance.Name='chrome.exe'
              OR TargetInstance.Name='msedge.exe'
              OR TargetInstance.Name='firefox.exe'
              OR ...)
  namespace: root\cimv2
consumer:
  executable: [REDACTED]
  command_line: [REDACTED]
binding: filter -> consumer
status: created

Persistence model

redacted WMI layout

Survives reboot without Run keys or scheduled tasks — removal requires deleting all three subscription objects.

sanitized-output
__EventFilter              CommandLineEventConsumer
+---------------------+    +---------------------------+
| Name: _[REDACTED]   |    | Name: _[REDACTED]         |
| Query: process start|    | ExecutablePath: [REDACTED]|
+---------------------+    +---------------------------+
          |                          |
          +-------- Binding ---------+
           __FilterToConsumerBinding
reboot_survival: yes
elevation_required: admin (root\subscription write)