Reconnaissance Using WMI Classes Via PowerShell Script Block

Kaung Khant Ko@kaungkhantko

•updated May 27, 2026•0•57

Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.