Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)

Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts – using `mofcomp.exe`  –into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018)

WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.
Windows Management Instrumentation Event Subscription
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1546/003  external_id: T1546.003     source_name: FireEye WMI 2015  description: Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.  url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf     source_name: Dell WMI Persistence  description: Dell SecureWorks Counter Threat Unit™ (CTU) Research Team. (2016, March 28). A Novel WMI Persistence Implementation. Retrieved March 30, 2016.  url: https://www.secureworks.com/blog/wmi-persistence     source_name: FireEye WMI SANS 2015  description: Devon Kerr. (2015). There's Something About WMI. Retrieved May 4, 2020.  url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf     source_name: Medium Detecting WMI Persistence  description: French, D. (2018, October 9). Detecting & Removing an Attacker’s WMI Persistence. Retrieved October 11, 2019.  url: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96     source_name: Elastic - Hunting for Persistence Part 1  description: French, D., Murphy, B. (2020, March 24). Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1). Retrieved December 21, 2020.  url: https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1     source_name: Mandiant M-Trends 2015  description: Mandiant. (2015, February 24). M-Trends 2015: A View from the Front Lines. Retrieved May 18, 2016.  url: https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf     source_name: Microsoft Register-WmiEvent  description: Microsoft. (n.d.). Retrieved January 24, 2020.  url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/register-wmievent?view=powershell-5.1     source_name: TechNet Autoruns  description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.  url: https://technet.microsoft.com/en-us/sysinternals/bb963902     source_name: Microsoft MOF May 2018  description: Satran, M. (2018, May 30). Managed Object Format (MOF). Retrieved January 24, 2020.  url: https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-     