User discovery via WMI query execution

Analytics BIOC Informational

User discovery via WMI query execution

Attackers or malware may use WMI queries to list the users of a host, and potentially its owner.

Module:: Platform Analytics
Data source:: XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Execution (TA0002) Discovery (TA0007)

ATT&CK techniques: Windows Management Instrumentation (T1047) System Owner/User Discovery (T1033) Account Discovery (T1087)

Attacker's goals:

Attacker or malware can use WMI queries to discover host users and enumerate a huge amount of information.

Investigative actions:

Examine the process that executed the WMI query and verify that the process is from a trusted source. Inspect the system for suspicious activity that is related to that process.

Test period:: N/A (single event)
Deduplication:: 1 Day

3 variations:

User discovery via WMI query execution by an unsigned process Low (parent: Informational)
User modification via WMIC query execution Low (parent: Informational) Adds Account Manipulation (T1098)
User discovery via WMIC query execution Informational