Windows WMIC Process Flag Execution Indicating Process Reconnaissance

title: Windows WMIC Process Flag Execution Indicating Process Reconnaissance
id: 91d1d4d6-2ea3-46e2-89ae-4f8d0b15b629
status: test
description: This rule identifies Windows executions of WMIC (wmic.exe) where the command line includes the 'process' flag, indicating possible reconnaissance of running processes. The behavior matters because querying process details is commonly used to understand what is running before further actions. It relies on process creation telemetry, matching WMIC executable identification and required command-line substrings, while excluding commands that include both 'call' and 'create'/'terminate'.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml
author: frack113, Huntrule Team
date: 2022-01-01
modified: 2025-12-15
tags:
  - attack.execution
  - attack.t1047
  - attack.discovery
  - attack.t1057
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \WMIC.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains: process
  filter_main_creation:
    CommandLine|contains|all:
      - call
      - create
  filter_main_terminate:
    CommandLine|contains|all:
      - call
      - terminate
  condition: all of selection* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
simulation:
  - type: atomic-red-team
    name: WMI Reconnaissance Processes
    technique: T1047
    atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml
license: DRL-1.1
related:
  - id: 221b251a-357a-49a9-920a-271802777cc0
    type: derived