Possible Product Class Recon Through Wmic.EXE (via process_creation)

title: Possible Product Class Recon Through Wmic.EXE (via process_creation)
id: 61e94adf-c592-5cd2-98e7-0bffe80bb8bf
status: stable
description: This rule detects the execution of WMIC to get a list of firewall, antivirus and antispywware products. Adversaries frequently enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate methods to bypass security measures.
references:
    - https://attack.mitre.org/techniques/T1082/
    - https://attack.mitre.org/techniques/T1047/
    - https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md
    - https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
    - https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html
author: Huntrule Team
date: 2026-04-27
tags:
    - attack.execution
    - attack.t1047
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains:
            - 'AntiVirusProduct'
            - 'AntiSpywareProduct'
            - 'FirewallProduct'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class/info.yml