DcRAT WMI Recon: AV Enumeration and System Info Sequence from Suspicious Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous use of WMI queries or the wmic.exe utility to gather system or antivirus configuration information from suspicious paths (e.g., Temp, AppData) or when executed by unexpected processes. This pattern often indicates early-stage discovery by malicious software.