DeviceManager: WMI process enumeration spawned by Python process from non-standard path
Detects wmic.exe process enumeration ("process list"/"where") spawned within 60 seconds by a python.exe or pythonw.exe process running from a non-standard path (AppData, Temp, or ProgramData), consistent with DeviceManager RAT reconnaissance behavior delivered via the DOUBLECUP ClickFix loader.
Cortex XDR
