Detection rules › Sigma

System Disk And Volume Reconnaissance Via Wmic.EXE

Severity
medium
Author
Stephen Lincoln '@slincoln-aiq' (AttackIQ)
Source
upstream

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation
DiscoveryT1082 System Information Discovery

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\WMIC.exe'
OriginalFileName: wmic.exe

Stage 2: all of selection_cli

or:
CommandLine|contains: ' list '
CommandLine|contains: ' volume'
CommandLine|contains: path
CommandLine|contains: win32_logicaldisk
CommandLine|contains: ' logicaldisk'
CommandLine|contains: ' volumename'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • list corpus 2 (sigma 2)
  • logicaldisk
  • volume
  • volumename
  • path corpus 2 (sigma 2)
  • win32_logicaldisk
Imageends_with
  • \WMIC.exe corpus 12 (sigma 12)
OriginalFileNameeq
  • wmic.exe corpus 33 (sigma 33)