New Process Created Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects the creation of new processes using the 'wmic.exe' utility with the 'process call create' command-line arguments. This is a common technique used by adversaries for execution.