huntrule

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

FreeUnreviewedSigmamediumv1
title: Windows WMIC System Reconnaissance Using "computersystem" Flag
id: f0b13b6d-b557-4579-a9ba-b6803db23c44
status: test
description: This rule identifies execution of wmic.exe with the "computersystem" flag, which queries host information such as domain, username, and hardware model. Attackers often use this kind of built-in system discovery to collect environment details before further actions. The detection relies on Windows process creation telemetry, specifically the executable name and the command-line content.
references:
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-08
modified: 2023-02-14
tags:
  - attack.discovery
  - attack.execution
  - attack.t1047
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains: computersystem
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml
license: DRL-1.1
related:
  - id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
    type: derived

What it detects

This rule identifies execution of wmic.exe with the "computersystem" flag, which queries host information such as domain, username, and hardware model. Attackers often use this kind of built-in system discovery to collect environment details before further actions. The detection relies on Windows process creation telemetry, specifically the executable name and the command-line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.