WMIC Remote Lateral Movement via /node: and process call create

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

Detects the use of wmic.exe to execute remote commands using the /node flag and the 'process call create' command string. This pattern is commonly used by adversaries for lateral movement and remote code execution.