Windows WMIC Product Reconnaissance via Firewall/AV Enumeration

title: Windows WMIC Product Reconnaissance via Firewall/AV Enumeration
id: 1e937b5c-4053-40e4-97c8-4c59e4d951ce
status: test
description: This rule flags process creation events where wmic.exe is executed with command-line content indicating product enumeration (e.g., the presence of the word 'Product' and WMIC product queries). Attackers may use WMIC to inventory installed products to inform follow-on targeting, such as identifying security software and related components. Detection relies on Windows process creation telemetry capturing the executable name (wmic.exe) and the associated command line arguments such as 'Product' and 'csproduct'.
references:
  - https://thedfirreport.com/2023/03/06/2022-year-in-review/
  - https://www.yeahhub.com/list-installed-programs-version-path-windows/
  - https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml
author: Nasreddine Bencherchali, Huntrule Team
date: 2023-02-14
modified: 2025-12-15
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains: Product
  filter_main_call_operations:
    CommandLine|contains:
      - " uninstall"
      - " install"
  filter_main_csproduct:
    CommandLine|contains: csproduct
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_product/info.yml
license: DRL-1.1
related:
  - id: 15434e33-5027-4914-88d5-3d4145ec25a9
    type: derived