Detectionmediumtest

Uncommon System Information Discovery Via Wmic.EXE

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

TropChaudCreated Thu Jan 26Updated Tue Dec 199d5a1274-922a-49d0-87f3-8c653483b909windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_wmic:
        - Description: 'WMI Commandline Utility'
        - OriginalFileName: 'wmic.exe'
        - Image|endswith: '\WMIC.exe'
    selection_commands:
        CommandLine|contains:
            - 'LOGICALDISK get Name,Size,FreeSpace'
            - 'os get Caption,OSArchitecture,Version'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0007 · Discovery

Techniques

T1082 · System Information Discovery

Related Rules

DerivedThreat Huntlow

System Information Discovery Via Wmic.EXE

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

9d5a1274-922a-49d0-87f3-8c653483b909

Status

test

Level

medium

Type

Detection

Created

Thu Jan 26

Modified

Tue Dec 19

Author

TropChaud

Path

rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml

Raw Tags

attack.discoveryattack.t1082

View on GitHub