Software Inventory Queried via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to query software inventory using 'wmic product' via a web shell. It specifically looks for HTTP requests where the URI contains the string 'wmic product', indicating a potential command execution to enumerate installed software on a compromised system.