WMI persistence is a Windows technique that abuses Windows Management Instrumentation event subscriptions to keep malware or a backdoor running after reboots. Attackers create permanent WMI objects such as an EventFilter, a CommandLineEventConsumer, and a binding between them, so that a chosen event can trigger their payload automatically. Because WMI is a built-in management feature, the activity can blend into normal system administration.
This matters in cyber security because it gives intruders a durable foothold without relying on obvious startup folders or scheduled tasks. Defenders look for unusual WMI repository changes, unexpected consumer commands, and filters that reference suspicious processes or event triggers. Hunting tools and incident responders often audit WMI subscriptions when a machine shows signs of stealthy access, since removing those artifacts is usually necessary to break the persistence chain.