Potential Product Reconnaissance Via Wmic.EXE
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Sigma
