HackTool - Wmiexec Default Powershell Command

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of PowerShell with a specific flag sequence ('-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc') that is characteristic of the Wmiexec script, often used for lateral movement and defense evasion.