Skip to content
Threat Feed

Tag

Cryptocurrency-Mining

1 brief RSS
high advisory

Detection of Process Termination via File Path Using WMIC

This analytic detects the use of `wmic.exe` with the `delete` command to terminate a process by specifying its executable path, often used to disable security tools or critical processes during the setup of malicious activities like cryptocurrency mining.

Splunk Enterprise +2 process-termination wmic cryptocurrency-mining endpoint
2r