Awesome

Wmi-Persistence

create a permanent WMI event subscription to achieve file-less persistence

Reference

• https://github.com/Sw4mpf0x/PowerLurk
• https://github.com/PowerShellMafia/PowerSploit/tree/master/Persistence
• https://github.com/n0pe-sled/WMI-Persistence