DcRAT WMI Security Product and System Reconnaissance via CommandLine

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects WMI reconnaissance commands targeting the SecurityCenter2 namespace (e.g., AntiVirusProduct, FirewallProduct) or system information (e.g., Win32_OperatingSystem) executed via wmic.exe, powershell.exe, or pwsh.exe. This activity is consistent with post-exploitation reconnaissance techniques utilized by DcRAT malware as observed in Operation DragonReturn.