Process Kill Based On File Path Using WMIC
The analytic detects the use of `wmic.exe` with the `delete` command to remove an executable path. This activity often indicates an adversary attempting to disable security tools or other critical processes, facilitating further compromise and persistence within the environment, potentially for malicious activities like cryptocurrency mining.
Splunk (SPL)
