TA4922 RAT WMI System and Hardware Discovery via Win32_ComputerSystem or Win32_PhysicalMedia
Detects the execution of wmic.exe with specific WMI queries (Win32_ComputerSystem, Win32_PhysicalMedia, Win32_PnPEntity) commonly used for system profiling and hardware discovery by threat actors like TA4922. The rule assigns a higher risk score when the process is launched from potentially suspicious locations such as user-writable or temporary directories.
YARA-L
