""ET ATTACK_RESPONSE Microsoft WMIC Prompt Outbound""

SID: 2020086

Revision: 1

Class Type: successful-admin

Metadata: created_at 2015_01_05, updated_at 2015_01_05

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established

Contents:

• Value: "wmic|3a|root|5c|cli>"

Within:

PCRE:

Special Options:

source