$#wmi-persistence

Hacker Holidays — Day 12: After Hours

Persistence hiding outside every autoruns tool's coverage — a malicious WMI class buried in the raw CIM repository carries a compressed .NET payload that only detonates on the domain controller by name.

• #hacker-holidays
• #forensics
• #wmi-persistence
• #dotnet-reversing