Grandoreiro WMI Process Execution and System Enumeration Correlation (T1047/T1057)
Detects suspicious WMI activities including the use of WMIC, PowerShell, and script hosts to perform enumeration of system configurations, installed antivirus products, or process listings. Additionally, it identifies suspicious child processes spawned by the WMI provider (wmiprvse.exe) such as cmd, mshta, or regsvr32. The rule uses behavioral thresholds (multiple WMI calls in 30 seconds) and identifies the execution of common analyst/security tools via WMI to flag potential reconnaissance or malicious execution.
Splunk (SPL)
