System profiling WMI query execution
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic
Execution (TA0002), Discovery (TA0007)
ATT&CK Technique
Windows Management Instrumentation (T1047), System Information Discovery (T1082)
Severity
Informational
Description
Attackers or malware may use WMI queries to identify the system and evade execution in sandbox environments.
Attacker's Goals
Attacker or malware can use WMI queries to identify system components and prevent execution in sandbox \ virtualized environments to evade detection.
Investigative actions
Examine the process that executed the WMI query and verify that the process is from a trusted source.
Inspect the system for suspicious activity that is related to that process.
Was this helpful?