car.2016-03-002 | Detection.FYI

Potential Product Class Reconnaissance Via Wmic.EXE
Mar 7, 2023 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:
Detects the execution of WMIC in order to get a list of firewall and antivirus products

Read More
Hardware Model Reconnaissance Via Wmic.EXE
Feb 16, 2023 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:
Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Read More
New Process Created Via Wmic.EXE
Feb 16, 2023 · attack.execution attack.t1047 car.2016-03-002 ·
Share on:
Detects new process creation using WMIC via the "process call create" flag

Read More