Gentlemen - WMI Remote Process Creation (T1047)
Correlates the ransomware utilizing WMI (Win32_Process Create) to remotely execute its copied binary on discovered lateral targets. This rule specifically looks for 'wmiprvse.exe' initiating a process where the initiating process is also 'wmiprvse.exe' and the folder path matches a common administrative share like 'Admin$' or 'C$'.
Microsoft Sentinel (KQL)
