WMI Remote Process Execution via wmiprvse.exe (T1047)
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
SentinelOne
