Process Discovery with PowerShell Get-WmiObject Win32_Process Query

Thomas Carr@Tomcat

•updated Aug 5, 2025•1•1•52

Detects PowerShell commands that use Get-WmiObject to query Win32_Process, specifically looking for process names. This can be indicative of discovery or reconnaissance activities using WMI. This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.