Remote execution through services and WMI
Tools such as PsExec, SMBExec and WMI clients start a process on another machine with administrator credentials. On the target machine the process appears as a child of services.exe (when a service was created for it) or of the WMI provider host, WmiPrvSE.exe. The recordings have five such starts. The clean Windows 10 client has 90 processes started by services.exe: svchost.exe, installers, update services and other software that runs as a service. Find the five remote starts.
Hint 1
ParentImage is the program that started the process. Programs written to run as a service are rarely command shells.
Hint 2
Not every remote start is a shell: PsExec runs through its own service binary, PSEXESVC.exe, and WMI can start any executable.
How to defend against remote execution through services and WMI
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,245 events. Search filters the table; it does not affect the result.