{"id":"c79da740-5030-45ec-a2e0-479e824a562c","title":"System Disk And Volume Reconnaissance Via Wmic.EXE","description":"An adversary might use WMI to discover information about the system, such as the volume name, size,\nfree space, and other disk information. This can be done using the 'wmic' command-line utility and has been\nobserved being used by threat actors such as Volt Typhoon.\n","author":"Stephen Lincoln '@slincoln-aiq' (AttackIQ)","status":"test","level":"medium","date":"2024-02-02","modified":"2025-10-20","tags":["attack.execution","attack.discovery","attack.t1047","attack.t1082"],"technique_ids":["T1047","T1082"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml","source_sha256":"c2da25b5ce390498ed9216a906279611fa9b58c0de9234e3f9908eae72c18cf5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Disk And Volume Reconnaissance Via Wmic.EXE\nid: c79da740-5030-45ec-a2e0-479e824a562c\nrelated:\n    - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e\n      type: similar\nstatus: test\ndescription: |\n    An adversary might use WMI to discover information about the system, such as the volume name, size,\n    free space, and other disk information. This can be done using the 'wmic' command-line utility and has been\n    observed being used by threat actors such as Volt Typhoon.\nreferences:\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\nauthor: Stephen Lincoln '@slincoln-aiq' (AttackIQ)\ndate: 2024-02-02\nmodified: 2025-10-20\ntags:\n    - attack.execution\n    - attack.discovery\n    - attack.t1047\n    - attack.t1082\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        - CommandLine|contains:\n              - ' volumename'\n              - ' logicaldisk'\n        - CommandLine|contains|all:\n              - 'path'\n              - 'win32_logicaldisk'\n        - CommandLine|contains|all:\n              - ' volume'\n              - ' list '\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_volume/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/c79da740-5030-45ec-a2e0-479e824a562c.json","kind":"sigma"}