examples:

• description: "Execute OpenVAS runs WMIExec and observe the unusual behavior" command: "OpenVAS runs WMIExec"

OpenVAS runs WMIExec

TFW the vuln scanner runs offensive tools.

When connecting to Windows hosts, OpenVAS will run impacket-wmiexec against the host. The resulting events look identical to a secretsdump run that you'd hunt for.

Contributed by mttaggart