CRPx0 WMI Lateral Movement via WmiPrvSE.exe Process Spawn
Detects potential lateral movement activity associated with the CRPx0 propagation technique. The rule monitors for WmiPrvSE.exe spawning unusual child processes (indicative of remote Win32_Process.Create execution) which are concurrently correlated with outbound network activity from the same host.
YARA-L
