sigmamediumHunting

System Disk And Volume Reconnaissance Via Wmic.EXE

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.

MITRE ATT&CK

T1047 T1082

executiondiscovery

Detection Query

selection_img:
  - Image|endswith: \WMIC.exe
  - OriginalFileName: wmic.exe
selection_cli:
  - CommandLine|contains:
      - " volumename"
      - " logicaldisk"
  - CommandLine|contains|all:
      - path
      - win32_logicaldisk
  - CommandLine|contains|all:
      - " volume"
      - " list "
condition: all of selection_*

Author

Stephen Lincoln '@slincoln-aiq' (AttackIQ)

Created

2024-02-02

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.executionattack.discoveryattack.t1047attack.t1082

Raw Content

title: System Disk And Volume Reconnaissance Via Wmic.EXE
id: c79da740-5030-45ec-a2e0-479e824a562c
related:
    - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e
      type: similar
status: test
description: |
    An adversary might use WMI to discover information about the system, such as the volume name, size,
    free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
    observed being used by threat actors such as Volt Typhoon.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
author: Stephen Lincoln '@slincoln-aiq' (AttackIQ)
date: 2024-02-02
modified: 2025-10-20
tags:
    - attack.execution
    - attack.discovery
    - attack.t1047
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        - CommandLine|contains:
              - ' volumename'
              - ' logicaldisk'
        - CommandLine|contains|all:
              - 'path'
              - 'win32_logicaldisk'
        - CommandLine|contains|all:
              - ' volume'
              - ' list '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium