Potential Process Reconnaissance via Wmic.EXE

Title: Potential Process Reconnaissance via Wmic.EXE
Status: test
Description:Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Author: frack113
Date: 2022-01-01
modified:2025-12-15
Tags:

• -'attack.execution'
• -'attack.t1047'
• -'attack.discovery'
• -'attack.t1057'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\WMIC.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains: 'process'
  filter_main_creation:
    CommandLine|contains|all:
      -'call'
      -'create'

  filter_main_terminate:
    CommandLine|contains|all:
      -'call'
      -'terminate'

  condition:all of selection* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium