Suspicious SMB File Write Followed by WMI Execution

Kaung Khant Ko@kaungkhantko

•updated yesterday•9•0•9

Detects potential lateral movement or remote code execution where a file (.exe, .dll, .dat, .msi) is written via SMB from a remote source IP, followed closely by WMI execution (WmiPrvSE.exe) spawning cmd.exe or powershell.exe referencing ADMIN$ shares and output redirection.