WmiPrvSE Spawns New Process
Detects when the WmiPrvSE.exe process spawns a new process. This activity can be indicative of malicious use of Windows Management Instrumentation (WMI) for execution, as WmiPrvSE.exe is a legitimate process that hosts WMI provider plug-ins. Adversaries often abuse WMI to execute commands or maintain persistence.
Sigma
