soc-hunting-wmi

Soc Hunting Wmi.

Files2

SKILL.mdskills/soc-hunting-wmi/SKILL.md

| | Sysmon | Windows event monitoring for WMI activity | | WMI Explorer | GUI tool for browsing WMI namespaces | | Autoruns | Sysinternals tool listing persistence mechanisms | | PowerShell Get-WMIObject | Enumerate WMI event subscriptions | | Splunk | SIEM analysis of Sysmon WMI events | | Velociraptor | Endpoint WMI artifact collection |

Output Format

Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]

Related in other

limits-colimits

Context management for Claude Code. Hooks maintain state via ledgers and handoffs. MCP execution without context polluti...

ddttom-allaboutv2-claude-skills-block-collection-and-party

The Block Collection and Block Party are repositories for existing AEM blocks, build tools, code snippets, integration p...

nodnarbnitram-claude-code-extensions-claude-skills-esphome-confi

This skill should be used when the user asks to "create an esphome config", "set up an esp32 device", "configure esphome...