Windows MOF Event Triggered Execution via WMI
Windows Management Instrumentation Event Subscription
Windows Management Instrumentation Event Subscription
Modify Registry
Domain Account, Account Discovery
Disable or Modify Tools, Impair Defenses
Remote System Discovery