Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)

This blog post outlines how attackers maintain persistence and demonstrates hunting and detection for WMI Event Subscriptions (MITRE ATT&CK T1084) using Elastic Security and EQL, including example EQL queries that correlate EventFilter, EventConsumer, and FilterToConsumerBinding creations, guidance on alerting (e.g., Windows Event ID 5861), and integrated Elastic Endpoint/SIEM workflows; it also previews a follow-up covering BITS Jobs (T1197) and Scheduled Tasks (T1053).