The attackers leverage WMI to create persistent footholds, enabling them to execute scripts remotely whenever the system restarts. Detected WMI subscription creation on host with persistent script execution capabilities.