WMIPrvSE spawning script host, encoded PowerShell, or temp binary

Arnold Chan@slaz

•updated 28 days ago•0•0•1

Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) launches suspicious command-line interfaces or interpreters (PowerShell, CMD, cscript, etc.), or executes scripts from sensitive/temporary directories. The rule includes exclusions for common management tools to reduce noise.