WMI Recon Burst: Multiple wmic/Get-WmiObject Win32_ Commands in 15m

Arnold Chan@slaz

•updated 27 days ago•1•0•1

Detects anomalous system reconnaissance activity performed using WMIC or PowerShell Get-WmiObject commands. The rule tracks distinct command-line executions per device and flags hosts where three or more unique reconnaissance commands are executed within a short timeframe, which is indicative of an adversary enumerating system configuration, hotfixes, or hardware details.