Potential SquiblyTwo Technique Execution via WMIC
Detects potential SquiblyTwo attack technique where WMIC is used to execute remote XSL files. This rule specifically looks for WMIC execution with command-line arguments indicating a format specifier and an HTTP URL, combined with checks for the original WMIC executable name or known WMIC ImpHashes, even if the binary is renamed.
Sigma
