PSExec and WMI Process Creations Block (97b9ce1e-c5ab-11ea-87d0-0242ac130003)

Detects blocking of process creations originating from PSExec and WMI commands

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055)	Attack Pattern	PSExec and WMI Process Creations Block (97b9ce1e-c5ab-11ea-87d0-0242ac130003)	Sigma-Rules	1
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	PSExec and WMI Process Creations Block (97b9ce1e-c5ab-11ea-87d0-0242ac130003)	Sigma-Rules	1
System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253)	Attack Pattern	Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	2