Skip to content
Threat Feed
Subscribe
medium advisory

Detection of WMIC System Information Discovery

This brief documents the use of Windows Management Instrumentation Command-line (WMIC) for reconnaissance, specifically focusing on the 'wmic computersystem' command used by adversaries to profile system environments.

Adversaries frequently employ built-in Windows utilities to conduct reconnaissance during the initial stages of a compromise. The Windows Management Instrumentation Command-line (WMIC) utility is often abused to gather detailed information about a target endpoint, including hardware model, manufacturer, domain membership, and system naming conventions.

This activity is identified through the execution of the command "wmic computersystem," which returns comprehensive system attributes. While this functionality is a standard administrative tool for system inventory and troubleshooting, its execution by non-administrative processes or users - or in suspicious parent-child process chains - is a key indicator of attacker profiling. This detection is applicable to environments where visibility into process creation, including complete command-line arguments, is available. Security teams should monitor for this behavior to detect unauthorized information gathering activities commonly seen in campaigns involving malwares like LAMEHUG, BlankGrabber, and the Lotus Blossom Chrysalis backdoor.

Impact

The abuse of system discovery tools allows adversaries to gain critical situational awareness, enabling them to tailor subsequent lateral movement, privilege escalation, or malware deployment strategies to the specific target environment. If left undetected, this reconnaissance phase allows attackers to refine their payloads and increase the likelihood of a successful long-term infiltration or data exfiltration effort.

Recommendation

Prioritize the detection of system discovery activities by monitoring process execution telemetry.

  • Deploy the Sigma rule provided in this brief to identify potential unauthorized use of WMIC for system profiling.
  • Ensure EDR agents or Sysmon (Event ID 1) are configured to log the full command-line arguments and parent process information to enable effective detection.
  • Review and tune the detection in environments where automated inventory or management scripts frequently invoke "wmic computersystem."

Immediate actions

Deploy the Sigma detection rule to monitor for WMIC computer system queries.

Detection Engineering 48h

Threat Hunt

Search for historical execution of 'wmic computersystem' in process logs to establish a baseline of administrative activity.

T1082 medium high confidence hunt now

Data: Process creation telemetry

Mitigations

Implement strict auditing of administrative tools and limit WMIC access to authorized service accounts.

medium IT Operations

T1082

Detection coverage 1

Detect WMIC Computer System Discovery

medium

Detects the use of WMIC to query computersystem information, which may indicate reconnaissance activity.

sigma tactics: discovery techniques: T1082 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →