Installed Software Enumerated via Remote WMI
This rule detects attempts to enumerate installed software on a Windows machine via Remote WMI (Windows Management Instrumentation) over SMB (Server Message Block) on port 445. Specifically, it looks for the string "Win32_Product" within TCP traffic destined for port 445, indicating a WMI query for installed products. A threshold of 5 occurrences within 30 seconds from the same source is set to reduce false positives.
Suricata
