Skip to content
Threat Feed

Tag

Wmic

2 briefs RSS
high threat

Suspicious WMIC Application Uninstallation

This analytic identifies the use of the WMIC command-line tool to uninstall applications non-interactively, a technique used to evade detection by removing security software, as observed in IcedID campaigns.

Splunk Enterprise +2 IcedID defense-evasion application-uninstall wmic
2r
high advisory

Detection of Process Termination via File Path Using WMIC

This analytic detects the use of `wmic.exe` with the `delete` command to terminate a process by specifying its executable path, often used to disable security tools or critical processes during the setup of malicious activities like cryptocurrency mining.

Splunk Enterprise +2 process-termination wmic cryptocurrency-mining endpoint
2r