Persist with a WMI permanent event subscription

A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no Run key.