System Disk And Volume Reconnaissance Via Wmic.EXE

Title: System Disk And Volume Reconnaissance Via Wmic.EXE
Status: test
Description:An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.
References:
  -https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Author: Stephen Lincoln '@slincoln-aiq' (AttackIQ)
Date: 2024-02-02
modified:2025-10-20
Tags:

• -'attack.execution'
• -'attack.discovery'
• -'attack.t1047'
• -'attack.t1082'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\WMIC.exe' OriginalFileName:'wmic.exe'   selection_cli:
    - CommandLine|contains:
      - ' volumename'
      - ' logicaldisk'
    - CommandLine|contains|all:
      - 'path'
      - 'win32_logicaldisk'
    - CommandLine|contains|all:
      - ' volume'
      - ' list '
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium