WMI Lateral Movement via wmic.exe /node: process call create
Detects the use of the WMIC.exe utility to execute processes on remote systems using the 'process call create' command. This technique is commonly used by adversaries for lateral movement. The rule excludes local execution scenarios.
SentinelOne
