Amadey/StealC WMI Enumeration and Termination of PowerShell Processes

Duo Tech@duotech

•updated Jun 30, 2026•1•0•3

Detects the use of WMI (via WmiPrvSE.exe or wmic.exe) to enumerate or terminate PowerShell processes. This behavior is indicative of the Amadey/StealC delivery chain, where a JScript dropper uses WMI to clean up script execution artifacts after a specified timeout, aiding in defense evasion.