Starland RAT System and Antivirus Reconnaissance via CIM/WMI Queries

Duo Tech@duotech

•updated Jul 16, 2026•2•0•9

Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.