sigmalowHunting

System Information Discovery Via Wmic.EXE

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions.

MITRE ATT&CK

T1082

discovery

Detection Query

selection_wmic:
  - Description: WMI Commandline Utility
  - OriginalFileName: wmic.exe
  - Image|endswith: \WMIC.exe
selection_get:
  CommandLine|contains: get
selection_classes:
  CommandLine|contains:
    - baseboard
    - bios
    - cpu
    - diskdrive
    - logicaldisk
    - memphysical
    - os
    - path
    - startup
    - win32_videocontroller
selection_attributes:
  CommandLine|contains:
    - caption
    - command
    - driverversion
    - maxcapacity
    - name
    - osarchitecture
    - product
    - size
    - smbiosbiosversion
    - version
    - videomodedescription
filter_optional_vmtools:
  ParentCommandLine|contains: \VMware\VMware Tools\serviceDiscovery\scripts\
condition: all of selection_* and not 1 of filter_optional_*

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Created

2023-12-19

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.discoveryattack.t1082detection.threat-hunting

Raw Content

title: System Information Discovery Via Wmic.EXE
id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e
related:
    - id: 9d5a1274-922a-49d0-87f3-8c653483b909
      type: derived
status: test
description: |
    Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
    including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,
    and GPU driver products/versions.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
    - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
    - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
    - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/
    - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/
    - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-12-19
modified: 2024-01-15
tags:
    - attack.discovery
    - attack.t1082
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_wmic:
        - Description: 'WMI Commandline Utility'
        - OriginalFileName: 'wmic.exe'
        - Image|endswith: '\WMIC.exe'
    selection_get:
        CommandLine|contains: 'get'
    selection_classes:
        CommandLine|contains:
            - 'baseboard'
            - 'bios'
            - 'cpu'
            - 'diskdrive'
            - 'logicaldisk'
            - 'memphysical'
            - 'os'
            - 'path'
            - 'startup'
            - 'win32_videocontroller'
    selection_attributes:
        CommandLine|contains:
            - 'caption'
            - 'command'
            - 'driverversion'
            - 'maxcapacity'
            - 'name'
            - 'osarchitecture'
            - 'product'
            - 'size'
            - 'smbiosbiosversion'
            - 'version'
            - 'videomodedescription'
    filter_optional_vmtools:
        ParentCommandLine|contains: '\VMware\VMware Tools\serviceDiscovery\scripts\'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - VMWare Tools serviceDiscovery scripts
# Note: Might be upgraded to a medium detection rules after some time
level: low