Remote WMI Execution via IWbemServices RPC
Detects remote command execution using WMI by monitoring RPC calls to the IWbemServices interface (UUID {9556DC99-828C-11CF-A37E-00AA003240C7}). The rule specifically targets the ExecMethod operation (opnum 24) commonly used by tools like Impacket's wmiexec to execute Win32_Process.Create on remote targets. Filter for COMSPEC to increase fidelity for detecting wmiexec.
Cortex XDR
