Possible System Disk And Volume Recon Through Wmic.EXE (via process_creation)

title: Possible System Disk And Volume Recon Through Wmic.EXE (via process_creation)
id: 024c0277-2484-55a9-bd9b-959db895bec9
status: stable
description: This rule detects an adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.
references:
    - https://attack.mitre.org/techniques/T1082/
    - https://attack.mitre.org/techniques/T1047/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
author: Huntrule Team
date: 2026-01-19
tags:
    - attack.execution
    - attack.discovery
    - attack.t1047
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        - CommandLine|contains:
              - ' volumename'
              - ' logicaldisk'
        - CommandLine|contains|all:
              - 'path'
              - 'win32_logicaldisk'
        - CommandLine|contains|all:
              - ' volume'
              - ' list '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_volume/info.yml