Suspicious execution via WMI from a Microsoft Office process

Identifies a suspicious process execution via Windows Management Instrumentation (WMI) originated from the Microsoft Office process loading an unusual WMI DLL. This technique can indicate code execution evading traditional parent/child processes spawned from Microsoft Office products.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso inicial
• Técnicas MITRE: T1566, T1566.001

Volver a todas las reglas