Potential Product Class Reconnaissance Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•16

Detects the execution of WMIC to enumerate installed firewall, antivirus, and antispyware products. Adversaries often perform this discovery to understand security controls, plan evasion tactics, or disable protection mechanisms.