Application Terminated Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects calls to the "terminate" function via wmic.exe in order to kill an application. This activity can be used by adversaries to hinder system recovery or disrupt services.