Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
심각도 보통 Sigma 탐지 룰. Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
작성자: Markus Neis @Karneades · 원본 라이선스: DRL 1.1 · SigmaHQ 원본
심각도 보통 Sigma 탐지 룰. Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
작성자: Markus Neis @Karneades · 원본 라이선스: DRL 1.1 · SigmaHQ 원본