System Disk And Volume Reconnaissance Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•0•23

This rule detects the use of 'wmic.exe' to perform system disk and volume reconnaissance. Specifically, it looks for command-line arguments related to querying volume names, logical disks, and general volume information. This activity has been observed in campaigns by threat actors such as Volt Typhoon.