T1047 Remote WMI Process Creation via wmic /node: or Invoke-WmiMethod

Arnold Chan@slaz

•updated 27 days ago•0•0•1

This rule detects potential remote command execution using Windows Management Instrumentation (WMI) via wmic.exe or PowerShell, as well as suspicious child processes spawned by the WMI provider host (wmiprvse.exe). It monitors for command lines utilizing the /node switch to target remote systems or invoking WMI methods to trigger execution, which are common patterns for lateral movement.