Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More

Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

Read More