Windows WMIC Process Flag Execution Indicating Process Reconnaissance
Alerts on wm ic.exe executions using the 'process' flag, consistent with attempting to enumerate running processes.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-30
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows executions of WMIC (wmic.exe) where the command line includes the 'process' flag, indicating possible reconnaissance of running processes. The behavior matters because querying process details is commonly used to understand what is running before further actions. It relies on process creation telemetry, matching WMIC executable identification and required command-line substrings, while excluding commands that include both 'call' and 'create'/'terminate'.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC Process Flag Execution Indicating Process Reconnaissance
id: 91d1d4d6-2ea3-46e2-89ae-4f8d0b15b629
status: test
description: This rule identifies Windows executions of WMIC (wmic.exe) where the command line includes the 'process' flag, indicating possible reconnaissance of running processes. The behavior matters because querying process details is commonly used to understand what is running before further actions. It relies on process creation telemetry, matching WMIC executable identification and required command-line substrings, while excluding commands that include both 'call' and 'create'/'terminate'.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml
author: frack113, Huntrule Team
date: 2022-01-01
modified: 2025-12-15
tags:
- attack.execution
- attack.t1047
- attack.discovery
- attack.t1057
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \WMIC.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains: process
filter_main_creation:
CommandLine|contains|all:
- call
- create
filter_main_terminate:
CommandLine|contains|all:
- call
- terminate
condition: all of selection* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
simulation:
- type: atomic-red-team
name: WMI Reconnaissance Processes
technique: T1047
atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml
license: DRL-1.1
related:
- id: 221b251a-357a-49a9-920a-271802777cc0
type: derived