Analytics BIOC
Medium
✕
Remote WMI process execution
A host that rarely initiates WMI to other remote hosts triggered a remote process execution by using WMI RPC.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services (T1021) Remote Services: Windows Remote Management (T1021.006)
Detector tags: Impacket Analytics
Attacker's goals:
Perform lateral movement to new hosts to expand the foothold within a network.
Investigative actions:
Investigate the processes being spawned on the host for malicious activities. Correlate the RPC call from the source host and understand which process or software initiated it.
- Test period:
- N/A (single event)
- Deduplication:
- 3 Days
1 variation:
- Suspicious remote WMI process execution High (parent: Medium)