An emergency-operations Windows host shows persistence implemented through WMI event subscriptions. How should IR classify that mechanism?
Select an answer to reveal the explanation.
Short Explanation
WMI event subscriptions that bring malware back are persistence with a Windows management twist. EOC IR should label it that way—not as scanning, phishing modules, or deepfake art. Right label, right eradication checklist.
Full Explanation
WMI event subscriptions are a recognized Windows persistence mechanism that can relaunch malicious actions when system events occur, surviving beyond a single interactive session. When an emergency-operations Windows host shows persistence implemented through WMI event subscriptions, IR should classify that mechanism as WMI-based persistence on a municipal Windows endpoint. Correct classification drives hunting for subscription artifacts, removing the event consumers/filters, and validating that EOC hosts will not silently re-infect after reboot or event triggers.
Primary network enumeration of the EOC VLAN fails because enumeration maps network services; it is not what WMI event subscriptions represent. Authorized SET module selection for phishing drills fails; Social-Engineer Toolkit module choice is assessment/phishing-drill tooling, not host persistence classification. Image deepfake face-swap used in awareness posters fails as a persistence label and belongs to a different topic area.
Exam caveat: name the persistence technology from the stem (WMI), not a nearby but unrelated Domain topic. Persistence ≠ enumeration ≠ deepfakes.
Operational check for EOC IR: inventory WMI permanent event subscriptions, remove unauthorized filters/consumers/bindings, delete associated payloads, reboot and re-query WMI persistence, hunt sibling EOC and mutual-aid Windows hosts for the same subscription names, and document the finding as persistence so eradication checklists are complete before the host returns to emergency operations.