Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.