{"id":"221b251a-357a-49a9-920a-271802777cc0","title":"Potential Process Reconnaissance via Wmic.EXE","description":"Detects the execution of \"wmic\" with the \"process\" flag, which might indicate an attempt to perform reconnaissance on running processes.\nAdversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.\n","author":"frack113","status":"test","level":"medium","date":"2022-01-01","modified":"2025-12-15","tags":["attack.execution","attack.t1047","attack.discovery","attack.t1057"],"technique_ids":["T1047","T1057"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml","source_sha256":"a2de36a81c89e9a4665ee479585bc049171d92dca392ef248f59bcea4937c238","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Process Reconnaissance via Wmic.EXE\nid: 221b251a-357a-49a9-920a-271802777cc0\nstatus: test\ndescription: |\n    Detects the execution of \"wmic\" with the \"process\" flag, which might indicate an attempt to perform reconnaissance on running processes.\n    Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\nauthor: frack113\ndate: 2022-01-01\nmodified: 2025-12-15\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.discovery\n    - attack.t1057\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains: 'process'\n    filter_main_creation:\n        CommandLine|contains|all:\n            # Rule id 526be59f-a573-4eea-b5f7-f0973207634d for `wmic process call create #{process_to_execute}`\n            - 'call'\n            - 'create'\n    filter_main_terminate:\n        CommandLine|contains|all:\n            # Rule id 49d9671b-0a0a-4c09-8280-d215bfd30662 for `wmic path win32_process where processid=#{processid_to_terminate} call terminate`\n            - 'call'\n            - 'terminate'\n    condition: all of selection* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\nsimulation:\n    - type: atomic-red-team\n      name: WMI Reconnaissance Processes\n      technique: T1047\n      atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","page":"techniques/enterprise/T1057/"}],"data_path":"data/detection-rules/221b251a-357a-49a9-920a-271802777cc0.json","kind":"sigma"}