1200KM / tag
attack.t1546.003 — sigma-tag tag
11 related reference pages for sigma-tag: attack.t1546.003.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE · sigma-rule
- Powershell WMI Persistence · sigma-rule
- Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
- WMI Backdoor Exchange Transport Agent · sigma-rule
- WMI Event Subscription · sigma-rule
- WMI Persistence · sigma-rule
- WMI Persistence - Command Line Event Consumer · sigma-rule
- WMI Persistence - Script Event Consumer · sigma-rule
- WMI Persistence - Script Event Consumer File Write · sigma-rule
- WMI Persistence - Security · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.