wmic.exe process call create spawning wscript.exe as LOLBin execution path

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the use of wmic.exe to spawn or interact with wscript.exe, which is a common pattern used by adversaries to execute scripts via WMI.