{"version":"2.1.196","anchor":"wmic-command-detection","canonical_anchor":"wmic-command-detection","heading":"wmic Command Detection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.196\/e\/wmic-command-detection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.196","markdown":"### wmic Command Detection\n\nThe Windows command security checker now detects `wmic` in addition to `Invoke-CimMethod` and `Invoke-WmiMethod`. The `wmic` tool can spawn arbitrary processes via `process call create`, execute XSL scripts via `\/format` or `\/translate`, or write arbitrary files via `\/output`, `\/append`, or `\/record`.\n\n**Evidence**\n\nUpdated WMI checker (search for `\"wmic can spawn arbitrary processes (process call create)\"`)"}