WMIC Remote Process Execution for Lateral Movement via /node:

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the use of wmic.exe to execute commands or retrieve OS information on remote systems by monitoring for the '/node:' flag in command lines. The rule excludes local host references (localhost, 127.0.0.1) to focus on remote management activity that may indicate lateral movement or remote code execution.