DragonForce/CRPx0 Lateral Movement via WMI and Remote Schtasks

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects lateral movement activities involving the use of WMIC to remotely create processes or Schtasks to remotely create scheduled tasks. These techniques are often used by threat actors, including those associated with DragonForce and CRPx0 ransomware, to propagate across a network by executing commands on remote systems.