Kazuar - WMI Encoded Tasking Execution (T1047)
Detects the WMI provider executing heavily encoded commands mapped to Kazuar's tasking structure for lateral movement. Specifically, it looks for 'wmiprvse.exe' initiating processes that execute PowerShell or cmd commands containing encoding indicators like 'enc' or 'FromBase64String'.
Microsoft Sentinel (KQL)
