What steps are required to clean up a WMI persistence subscription created via wmic?

You must delete all three components in the correct order: first the `__FilterToConsumerBinding`, then the `CommandLineEventConsumer`, and finally the `__EventFilter`. Use wmic DELETE commands like `wmic /NAMESPACE:"\\root\\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='BotFilter82'" DELETE` (note: use single quotes for the filter name). PowerShell can also be used for cleanup, but wmic provides a command-line alternative.