Windows WMI Disk and Volume Discovery via WMIC.exe

title: Windows WMI Disk and Volume Discovery via WMIC.exe
id: ffb61cea-593c-4887-97fe-708330de3b36
related:
  - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e
    type: similar
  - id: c79da740-5030-45ec-a2e0-479e824a562c
    type: derived
status: test
description: This rule identifies process creation events where WMIC.exe is used to query logical disk and volume information. Attackers may use these queries to enumerate local storage capacity and available space to inform staging and privilege or data access decisions. It relies on Windows process creation telemetry, matching WMIC.exe execution and specific command-line terms indicative of disk/volume enumeration.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml
author: Stephen Lincoln '@slincoln-aiq' (AttackIQ), Huntrule Team
date: 2024-02-02
modified: 2025-10-20
tags:
  - attack.execution
  - attack.discovery
  - attack.t1047
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \WMIC.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    - CommandLine|contains:
        - " volumename"
        - " logicaldisk"
    - CommandLine|contains|all:
        - path
        - win32_logicaldisk
    - CommandLine|contains|all:
        - " volume"
        - " list "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_volume/info.yml
license: DRL-1.1