Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell — Detection Rule

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Read the full analysis on IntelFusions