Potential Lateral Movement via WMI or PsExec
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
Microsoft Sentinel (KQL)
