Process Reconnaissance Via Wmic.EXE
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Sigma
