Persistent Asynchronous and Fileless Backdoor

WMI Attacks – C2 Communication• WMI is a fantastic C2 channel!• The following can be used to stage exfil– Namespace• WMI Shell already does it– WMI class creation• One group already kind of does it– Registry• No one I know of is doing this– Ideas? Let’s chat