car.2016-03-002 | Detection.FYI

Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More
New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects new process creation using WMIC via the "process call create" flag

Read More
Potential Product Class Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More