CryptoBandits WMI Win32_Process taskmgr.exe Anti-Analysis Check from wscript/cscript
This rule detects instances where wscript.exe or cscript.exe initiate a WMI activity that specifically queries for 'Win32_Process' and contains 'taskmgr.exe' within the query. This combination can indicate an attempt to enumerate or interact with the Task Manager process via scripting, which might be indicative of malicious activity such as process hiding or manipulation.
Microsoft Sentinel (KQL)
