Wmiexec Default Output File Creation

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•27

Detects the creation of the default output filename used by the wmiexec tool, which is part of the Impacket toolkit. This typically indicates lateral movement or execution of commands via WMI.