Local Groups Reconnaissance Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of "wmic" with the "group" flag to discover local system groups and their members. This activity can indicate an adversary attempting to map the environment for privilege escalation opportunities.