examples:

• description: "Execute CCM.exe (SCCM) and observe the unusual behavior" command: "CCM.exe"

CCM.exe (SCCM)

Windows Config Manager CCM.exe runs b64-encoded powershell.

The commands can be large enough to take multiple Event 4104 entries.

Contributed by mttaggart