Detection of System Information Discovery Techniques on Windows

This detection analytic identifies common system information discovery techniques utilized by threat actors to map a compromised Windows environment. By monitoring process execution logs from EDR or Sysmon, the analytic triggers when a user or process executes multiple enumeration commands within a short window - specifically targeting wmic qfe, systeminfo, and hostname.

These commands are frequently abused by attackers during the early stages of an intrusion to collect data regarding patches, system configuration, and network identity. Such reconnaissance allows adversaries to refine their exploitation path, determine target privilege levels, and tailor their persistence or exfiltration strategies. The analytic is designed to reduce noise by requiring a threshold of more than two unique discovery commands per host, which effectively separates malicious reconnaissance activity from legitimate administrative debugging or maintenance.

Impact

Successful system discovery provides attackers with actionable intelligence on the target host, directly enabling follow-on post-exploitation activities such as privilege escalation, lateral movement, or targeted data exfiltration. This behavior has been observed across a wide array of threat groups, including those deploying ransomware like BlackSuit and Medusa, and stealer malware such as BlankGrabber, which leverage this data to customize their operational impact.

Recommendation

Prioritize the implementation of process-creation logging across all Windows endpoints to ensure the necessary telemetry is available for the detection analytic.

• Enable Sysmon (Event ID 1) or Windows Security Event Logs (Event ID 4688) to capture detailed command-line arguments.
• Map your EDR process-creation logs to the Endpoint data model within your SIEM using the Common Information Model (CIM) to enable the analytic logic.
• Deploy the provided detection logic and tune the dc(process) threshold as needed to minimize false positives from administrative activity.
• Integrate the drilldown searches to correlate this discovery activity with historical risk events for the target host to assess whether the discovery is part of a broader, ongoing compromise.