WMI Lateral Movement via WmiPrvSE Child Process or Remote wmic/Invoke-WmiMethod

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

This rule detects potential lateral movement via WMI by identifying two distinct suspicious behaviors: WmiPrvSE.exe spawning unexpected child processes (excluding common legitimate processes) or the usage of wmic.exe and PowerShell cmdlets (Invoke-WmiMethod, Invoke-CimMethod) to execute processes on remote systems, as indicated by command line arguments specifying target nodes or computer names.