• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    GreenBlood WMIC UUID Enumeration for Victim Fingerprinting

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 24, 2026•0•0•1

    Detects the use of WMIC to query for the system's UUID. This activity is often performed by adversaries during the discovery phase to gather system information.

    Microsoft Sentinel (KQL)

    Tags

    T1047 - Windows Management InstrumentationT1082 - System Information DiscoveryTA0002 - ExecutionTA0007 - DiscoveryCommand ExecutionProcess CreationWindowsWindows Wmi Servicekql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?