Skip to content

Hide Navigation Hide TOC

Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell (692f0bec-83ba-4d04-af7e-e884a96059b6)

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Cluster A Galaxy A Cluster B Galaxy B Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell (692f0bec-83ba-4d04-af7e-e884a96059b6) Sigma-Rules 1
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell (692f0bec-83ba-4d04-af7e-e884a96059b6) Sigma-Rules 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2