Suspicious Wsmprovhost.exe Process Creation (WinRM Activity)
This rule detects suspicious process creation events where 'wsmprovhost.exe' (Windows Remote Management Provider Host) is the parent process. Wsmprovhost.exe is legitimately used for remote management via WinRM, but its child processes can indicate remote execution of commands or scripts, which is often abused by adversaries for lateral movement or execution.
Cortex XDR
