WMIC Unquoted Services Path Lookup - PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts