Application Removed Via Wmic.EXE (b53317a0-8acf-4fd1-8de8-a5401e776b96)
Detects the removal or uninstallation of an application via "Wmic.EXE".
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Application Removed Via Wmic.EXE (b53317a0-8acf-4fd1-8de8-a5401e776b96) | Sigma-Rules | Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) | Attack Pattern | 1 |