All Detections

WMI Abuse for Lateral Movement and Persistence

avatar
Danny Y@zendannyy
updated Mar 11, 20262093

Detects WMI abuse for lateral movement, remote execution, and persistence. Using native WMI, and one condition for PowerShell plus WMI queries

Sigma