Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-wmi-persistencenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-wmi-persistence -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-wmi-persistence -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-wmi-persistencegh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-wmi-persistencegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-wmi-persistence ~/.claude/skills/detecting-wmi-persistence # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-wmi-persistence ~/.agents/skills/detecting-wmi-persistence # Codex, Cursor, Gemini CLI, Copilot, OpenCode