Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Title: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
Status: stable
Description:Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
References:
  -https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e
Author: Markus Neis @Karneades
Date: 2019-04-03
modified:2023-03-29
Tags:

• -'attack.execution'
• -'attack.t1047'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith: '\WmiPrvSE.exe'
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  condition:all of selection_*
Falsepositives:
  -AppvClient
  -CCM
  -WinRM
Level: medium