Cortex XDR
#Scenario
Hunt for lateral movement indicators by identifying anomalous Windows Management Instrumentation activity that signals an attacker is executing code across your internal network.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet -
## Wmic remote process creation.
Scenario: a scenario in which an attacker uses `wmic` to fan out command execution to other hosts.
The `process call create /node:` pattern is a classic hands-on-keyboard lateral-movement shape that still surfaces in intrusion reports through 2025-2026, despite Microsoft deprecating the binary.
- [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
- [https://lolbas-project.github.io/lolbas/Binaries/Wmic/](https://lolbas-project.github.io/lolbas/Binaries/Wmic/)
Logic: the three keywords together (`process`, `call`, `create`) catch both local and `/node:` remote variants. Most legitimate admin scripts will have a recognisable parent; ad-hoc operator activity will not.xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "wmic.exe"
| filter lowercase(action_process_image_command_line) contains "process"
and lowercase(action_process_image_command_line) contains "call"
and lowercase(action_process_image_command_line) contains "create"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200