High Volume of WMI Process Executions
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Microsoft Sentinel (KQL)
