Suspicious Scripting in a WMI Consumer

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•7

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers