Potential Product Reconnaissance Via Wmic.EXE

Title: Potential Product Reconnaissance Via Wmic.EXE
Status: test
Description:Detects the execution of WMIC in order to get a list of firewall and antivirus products
References:
  -https://thedfirreport.com/2023/03/06/2022-year-in-review/
  -https://www.yeahhub.com/list-installed-programs-version-path-windows/
  -https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product
Author: Nasreddine Bencherchali
Date: 2023-02-14
modified:2025-12-15
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\wmic.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains: 'Product'
  filter_main_call_operations:
    CommandLine|contains:
      -' uninstall'
      -' install'

  filter_main_csproduct:
    CommandLine|contains: 'csproduct'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium