Hellow guys, Welcome to my website, and you are watching The ABCs of WMI - Finding Evil in Plain Sight. and this vIdeo is uploaded by 13Cubed at 2021-02-15T06:22:40-08:00. We are pramote this video only for entertainment and educational perpose only. So, I hop you like our website.
| Name | The ABCs of WMI - Finding Evil in Plain Sight |
| Video Uploader | Video From 13Cubed |
| Upload Date | This Video Uploaded At 15-02-2021 14:22:40 |
| Video Discription | To date, WMI is one of the few forensic topics that hasn't been widely covered on this channel. Let's fix that and explore how we can separate legitimate WMI usage from attacker activity. We'll start with a review and cover the basics of this technology. Then we'll spend the rest of the episode looking at how we can enumerate the contents of the WMI database on a live system and on a dead system. *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** 📖 Chapters 00:00 - Intro 04:37 - Analyzing WMI with Autoruns for Windows 06:41 - Analyzing WMI with PowerShell 09:48 - Using KAPE to Acquire WMI Artifacts 11:09 - Using PyWMIPersistenceFinder.py 14:16 - Recap 🛠 Resources Autoruns for Windows: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns KAPE: https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape PyWMIPersistenceFinder.py: https://github.com/davidpany/WMI_Forensics MITRE ATT&CK - Windows Management Instrumentation: https://attack.mitre.org/techniques/T1047/ #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics |
| Category | Science & Technology |
| Tags | forensics | digital forensics | DFIR | WMI | Windows Management Instrumentation | MI | Microsoft MI | Management Infrastructure | WMI forensics | WMI persistence | WMI event filter | WMI event consumer | WMI filter to consumer binding | WMI malware | WMIC | Invoke-WMIMethod | WBEM | OBJECTS.DATA | mofcomp.exe | mofcomp | .mof file | mof file | T1047 | MITRE ATT&CK T1047 | APT29 | APT32 | APT41 | Solorigate | SUNBURST | TEARDROP | SolarWinds malware | SolarWinds breach | PyWMIPersistenceFinder | David Pany |
