Skip to content
Threat Feed
Subscribe

Actor

DEV-0270

1 brief RSS
medium threat

Computer System Reconnaissance Via Wmic.EXE

This brief details the use of `wmic.exe` with the `computersystem` flag for reconnaissance, a technique observed in campaigns by adversaries such as DEV-0270 (Phosphorus), to gather system information like domain, username, and model.

Windows DEV-0270 +5 discovery reconnaissance ransomware
1r 1t