Ah, good to know that there's people still making a complete mockery of windows even now. Do note that VBS mitigates a majority of 'buffer overflow' exploits a

Ah, good to know that there's people still making a complete mockery of windows even now. Do note that VBS mitigates a majority of 'buffer overflow' exploits and Microsoft has historically shown to brush off these vulnerabilities so that 100k bounty is pretty far fetched. Any WMI operation does touch the disk (because it's a database), but similar to any kind of other database they're mixed with writes that happen in a normal environment and are not really possible to tell between malicious applications. WMI requires administrator privileges to write so the privilege escalation is not that interesting except in limited environments (and Microsoft has also shown in the past that they don't care about these), which is fair considering you can't call 'sudo' a security vulnerability.