PowerShell Base64 Encoded WMI Class Usage
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Sigma
