WMI Remote Execution

Detects remote execution via WMI (wmic process call create, Invoke-WmiMethod) — a fileless lateral movement technique.

🔒

Premium Content

This query requires an active subscription to access the code.