Hannibal Stealer WMI Win32_Process enumeration via ManagementObjectSearcher

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects suspicious Windows Management Instrumentation (WMI) queries used for process and hardware enumeration. It monitors for common WMI queries that are often leveraged by malicious actors for discovery and reconnaissance, including queries for Win32_Process and Win32_Processor. It also identifies activity associated with Hannibal Stealer, specifically its use of CefSharp components to facilitate staging and process interaction.