Windows WMIC System Information Discovery via WMI Command-Line

title: Windows WMIC System Information Discovery via WMI Command-Line
id: 04a161d1-4e83-4896-b853-e46d66816de8
related:
  - id: 9d5a1274-922a-49d0-87f3-8c653483b909
    type: derived
  - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e
    type: derived
status: test
description: This rule identifies process executions of WMIC (wmic.exe) that query WMI classes to enumerate local system details such as operating system, CPU, disk drives/logical disks, memory capacity, baseboard, BIOS, and video controller/GPU driver information. Attackers often use this kind of discovery to profile the host and tailor subsequent actions during discovery and staging. It relies on Windows process creation telemetry, specifically the process image name ending in WMIC.exe and the command-line containing both the required WMI 'get' pattern and targeted WMI class/attribute keywords, while excluding VMware Tools service discovery script activity.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
  - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
  - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
  - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/
  - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/
  - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wmic_recon_system_info.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-19
modified: 2024-01-15
tags:
  - attack.discovery
  - attack.t1082
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmic:
    - Description: WMI Commandline Utility
    - OriginalFileName: wmic.exe
    - Image|endswith: \WMIC.exe
  selection_get:
    CommandLine|contains: get
  selection_classes:
    CommandLine|contains:
      - baseboard
      - bios
      - cpu
      - diskdrive
      - logicaldisk
      - memphysical
      - os
      - path
      - startup
      - win32_videocontroller
  selection_attributes:
    CommandLine|contains:
      - caption
      - command
      - driverversion
      - maxcapacity
      - name
      - osarchitecture
      - product
      - size
      - smbiosbiosversion
      - version
      - videomodedescription
  filter_optional_vmtools:
    ParentCommandLine|contains: \VMware\VMware Tools\serviceDiscovery\scripts\
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - VMWare Tools serviceDiscovery scripts
level: low
license: DRL-1.1