Hardware Model Reconnaissance Via Wmic.EXE
Detects the execution of WMIC with the "csproduct" argument, which is used by adversaries to obtain information such as hardware models and vendor details from a system. This can be part of reconnaissance activities.
Sigma
