VBScript WMI system fingerprinting query prior to C2 check-in

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•4

Detects wscript.exe or cscript.exe executing VBScript to query WMI classes (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor) or 'Basic System' information. This activity is often used for host reconnaissance and fingerprinting by threat actors prior to C2 check-in, notably observed in Kimsuky multi-stage tradecraft.