[WINDOWS-SECURITY] Possible lateral movement via wmic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Possible lateral movement via wmic"; program:*Secruity
| *Sysmon; event_id:1,4688; content:"wmic /node
| 3a
| "; nocase; content:"process call create"; nocase; content:"cmd.exe /c"; reference:url,thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/; classtype:trojan-activity; sid:5013920; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0008, mitre_technique_id T1570;)