examples:

• description: "Execute EndpointBasecamp.exe, RiskIndexCollector.exe and observe the unusual behavior" command: "EndpointBasecamp.exe, RiskIndexCollector.exe"

EndpointBasecamp.exe, RiskIndexCollector.exe

A little wmic enumeration

Trend Micro EndpointBasecamp.exe drops RiskIndexCollector.exe which invoke wmic to get list of Hotfixes/Patches using the command wmic qfe get Description, HotfixID, InstalledOn

Contributed by Thurein Oo