Lateral movement via WMI /node or remote schtasks creation
Detects the use of administrative utilities 'wmic.exe' and 'schtasks.exe' to execute commands or create scheduled tasks on remote systems, excluding local execution scenarios.
SentinelOne
Detects the use of administrative utilities 'wmic.exe' and 'schtasks.exe' to execute commands or create scheduled tasks on remote systems, excluding local execution scenarios.
Already have an account?