T1546.003
Event Triggered Execution: Windows Management Instrumentation Event Subscription
Event Triggered Execution: Windows Management Instrumentation Event Subscription
Event Triggered Execution: Screensaver
Event Triggered Execution: Change Default File Association
Create or Modify System Process: Launch Daemon
Create or Modify System Process: Windows Service