WMI Permanent Event Subscription - Sysmon
Windows Management Instrumentation Event Subscription , Event Triggered Execution
Windows Management Instrumentation Event Subscription , Event Triggered Execution
Masquerading , Rename System Utilities
User Execution , Malicious File
Application Shimming , Event Triggered Execution