WMIC Remote Command Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the execution of WMIC to query information on a remote system, specifically looking for the '/node:' command-line argument to identify remote interactions, while filtering out local connections to 127.0.0.1 or localhost.