LCRYX WMI Lateral Movement via wscript/cscript Spawning wmic for Subnet Propagation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the use of Wscript.exe or Cscript.exe to spawn wmic.exe with arguments indicative of remote WMI execution, such as 'Win32_Process', 'process call create', or '/node:'. This pattern is frequently associated with lateral movement, worm propagation (like VBScript-based malware), and ransomware deployment.