Wmi event subscription persistence
Skill ShulkwiSEC/bb-huge/skills/curated/wmi-event-subscription-persistence
bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents
npx -y skills add ShulkwiSEC/bb-huge --skill wmi-event-subscription-persistenceAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.9 KB, as published. Nobody here has run it
WMI Event Subscription Persistence — CONSOLIDATED
⚠️ This skill has been consolidated. The canonical, comprehensive version is:
red-teaming/persistence/wmi-event-subscriptionsThat skill includes:
- 4 trigger types (startup, user logon, process launch, time-based)
- 2 consumer types (CommandLineEventConsumer, ActiveScriptEventConsumer)
- Full OPSEC guidance and cleanup procedures
- Comprehensive Blue Team detection via Sysmon Event IDs 19/20/21
- Decision flowchart for choosing the right approach
When to Use
Use wmi-event-subscriptions instead of this skill. This entry exists for backward compatibility.
Prerequisites
- See the
wmi-event-subscriptionsskill for full prerequisites
Workflow
Phase 1: Redirect to Canonical Skill
Refer to red-teaming/persistence/wmi-event-subscriptions for the complete workflow.
Key Concepts
| Concept | Description |
|---|---|
| Consolidated Skill | This was merged with two other WMI skills into a single comprehensive wmi-event-subscriptions skill |
Proof of Concept (PoC)
# Standard payload injection format
curl -X POST https://target/api -d 'exploit=true'
🔵 Blue Team
- Deploy robust WAF rules to detect anomalies.
- Monitor logs for unusual access patterns.
🛡️ Remediation & Mitigation Strategy
- Input Validation: Sanitize and strictly type-check all inputs.
- Least Privilege: Constrain component execution bounds.
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
References
-
See
red-teaming/persistence/wmi-event-subscriptionsfor all references