[WINDOWS-CORRELATED] Possible remote WMIC command execution

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-CORRELATED] Possible remote WMIC command execution"; program: *Security*; event_id:4624; content: "Logon Type
| 3a
| 3"; meta_content:!"Source Network Address
| 3a
| %sagan%",-,127.0.0.1,
| 3a 3a
| 1; content:!"$ Account Domain
| 3a
| "; flexbits:isset,by_src,client.process.wmic; flexbits:noalert; parse_src_ip:1; flexbits:set,server.process.wmiprvse,10; reference:url,https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/; reference: url,findingbad.blogspot.cz/2017/12/a-few-of-my-favorite-things-continued.html; sid:5003386; classtype:suspicious-login; rev:11;)