DcRAT System Recon via systeminfo.exe and wmic AV Enumeration
Detects reconnaissance activities performed by DcRAT where svchost.exe (as an injection target) or specific suspected malicious process names launch systeminfo.exe or wmic.exe to perform OS version fingerprinting or security software enumeration, such as checking for antivirus products.
SentinelOne
