Possible Process Recon through Wmic.EXE (via process_creation)

title: Possible Process Recon through Wmic.EXE (via process_creation)
id: cd657682-676c-5314-9cc2-a5b64280b580
status: stable
description: This rule detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
references:
    - https://attack.mitre.org/techniques/T1057/
    - https://attack.mitre.org/techniques/T1047/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
author: Huntrule Team
date: 2026-06-07
tags:
    - attack.execution
    - attack.t1047
    - attack.discovery
    - attack.t1057
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains: 'process'
    filter_main_creation:
        CommandLine|contains|all:
            - 'call'
            - 'create'
    filter_main_terminate:
        CommandLine|contains|all:
            - 'call'
            - 'terminate'
    condition: all of selection* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: WMI Reconnaissance Processes
      technique: T1047
      atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml