WMI Remote Process Creation via wmic.exe /node: Lateral Movement
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
Splunk (SPL)
