Turla Kazuar v3 WMI Reconnaissance

Daniel Jeremiah@daniyyell

•updated Jan 18, 2026•1•0•17

Detects Windows Management Instrumentation (WMI) queries performed by wscript.exe that include specific reconnaissance-related keywords such as 'Win32_OperatingSystem', 'Win32_Process', 'LastBootUpTime', and 'PROCESSOR_ARCHITECTURE'. This activity is indicative of system reconnaissance, potentially by malware like Turla Kazuar v3 VBScript loader.