Potential Product Class Reconnaissance Via Wmic.EXE

 1title: Potential Product Class Reconnaissance Via Wmic.EXE
 2id: e568650b-5dcd-4658-8f34-ded0b1e13992
 3status: test
 4description: Detects the execution of WMIC in order to get a list of firewall and antivirus products
 5references:
 6    - https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md
 7    - https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
 8author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
 9date: 2023-02-14
10modified: 2023-03-07
11tags:
12    - attack.execution
13    - attack.t1047
14    - car.2016-03-002
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_img:
20        - Image|endswith: '\wmic.exe'
21        - OriginalFileName: 'wmic.exe'
22    selection_cli:
23        CommandLine|contains:
24            - 'AntiVirusProduct'
25            - 'FirewallProduct'
26    condition: all of selection_*
27falsepositives:
28    - Unknown
29level: medium

References

• malware-notes/Ransomware/Maze.md at c820c7fea76cf76a861b28ebc77e06100e20ec29 · albertzsigovits/malware-notes

  

  Notes and IoCs of fresh malware. Contribute to albertzsigovits/malware-notes development by creating an account on GitHub.

  
  Read More

• Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'java.z.jar'

  Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

  
  Read More

Related rules

• Hardware Model Reconnaissance Via Wmic.EXE
• New Process Created Via Wmic.EXE
• Application Removed Via Wmic.EXE
• Application Terminated Via Wmic.EXE
• Blue Mockingbird