Hardware Model Reconnaissance Via Wmic.EXE

Title: Hardware Model Reconnaissance Via Wmic.EXE
Status: test
Description:Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information
References:
  -https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/
  -https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks
Author: Florian Roth (Nextron Systems)
Date: 2023-02-14
modified:None
Tags:

• -'attack.execution'
• -'attack.t1047'
• -'car.2016-03-002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\wmic.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains: 'csproduct'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium