Remote WMIC Launches a Batch File from ProgramData
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Cortex XDR
