# Security2019. 8. 22. 15:44[파워쉘]wmi 네임스페이스에 등록된 악성스크립트 삭제

get-wmiobject -namespace root\subscription -class __eventconsumer -filter "__path like '%MYASECdr%'" | remove-wmiobject 참고 : https://everything-powershell.com/windows-server-2012-2012-r2-2016-remove-malware-embedded-in-wmi-with-powershell/ https://vstarmanv.tistory.com/96

image