Suspicious Non PowerShell WSMAN COM Provider

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•2

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.