WMI Event Consumer Created Named Pipe (493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb)
Detects the WMI Event Consumer service scrcons.exe creating a named pipe
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| WMI Event Consumer Created Named Pipe (493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb) | Sigma-Rules | Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) | Attack Pattern | 1 |