Service Reconnaissance Via Wmic.EXE
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Sigma
