Atlas RAT Host Reconnaissance: systeminfo or WMIC Spawned from Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•1

Detects the execution of systeminfo.exe or wmic.exe for hardware and operating system discovery when initiated by a process located in user-writable or temporary directories, such as AppData, Temp, ProgramData, or Downloads. This behavior is characteristic of post-infection reconnaissance by malware loaders or RATs.