Windows wmic.exe Hardware Model Reconnaissance Using csproduct

title: Windows wmic.exe Hardware Model Reconnaissance Using csproduct
id: 8c66099a-05ee-42da-8cbe-5559efbe208a
status: test
description: This rule identifies execution of wmic.exe where the command line contains the "csproduct" parameter, which is used to query hardware model and vendor information. Attackers can use this to profile a victim environment and tailor subsequent actions. The detection relies on Windows process creation telemetry, matching the executable name/path and the presence of "csproduct" in the command line.
references:
  - https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/
  - https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-02-14
tags:
  - attack.execution
  - attack.t1047
  - car.2016-03-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains: csproduct
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct/info.yml
license: DRL-1.1
related:
  - id: 3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d
    type: derived