Successful Account Login Via WMI

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects successful logon attempts that occur via the Windows Management Instrumentation (WMI) service, specifically when the WmiPrvSE.exe process is involved. This can indicate an adversary using WMI for execution or lateral movement.