SOC134 EventID:81 — Suspicious WMI Activity — letsdefend.io

SOC134 EventID:81 — Suspicious WMI Activity — letsdefend.io

In this article we continue where we left off with letsdefend.io alert solutions, with SOC134 EventID:81 — Suspicious WMI Activity.

Let’s take a look at the alert first.

EventID :81
Event Time :Mar, 15, 2021, 10:57 PM
Rule :SOC134 - Suspicious WMI Activity
Level :Security Analyst
Source Address :172.16.20.3
Source Hostname :Exchange Server
File Name :lunch.exe
File Hash :f2b7074e1543720a9a98fda660e02688
File Size :6.66 Mb
Device Action :Cleaned

The alert suggests a potential security …

address alert article blue team continue cybersecurity exchange letsdefendio malware analysis security soc solutions wmi