WMI Lateral Movement: wmic/wmiprvse Spawning Shells or Remote Process Create

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.