Question

While reviewing a compromised Windows workstation, an analyst runs a WMI query and discovers a __EventFilter bound to a CommandLineEventConsumer that launches a PowerShell script whenever system uptime reaches 200 seconds. No corresponding scheduled task or registry Run key entry exists. Which conclusion best describes what the analyst has found?

Accepted Answer

A WMI event subscription is being used as a fileless persistence mechanism that survives reboots

Answer

A benign performance-monitoring agent configured by the desktop team

Answer

A DLL side-loading technique used to evade application allow-listing

Answer

A one-time process injection that will not persist after the current session ends