Environment Variable Enumeration Via WMIC

Rule Info

Name
Environment Variable Enumeration Via WMIC
Author
Swachchhanda Shrawan Poudel, Christian Burkard
Description
Detects enumeration of environment variables via WMIC using the Win32_Environment class. Attackers query "environment get name,variablevalue" during host reconnaissance to discover paths, usernames, and configuration values useful for lateral movement or payload staging.
Reference
https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-environment
Date
2026-07-01 00:00:00
Modified
None
Id
10bae869-e9e3-4700-b967-0e97dbca82cc
Tags
attack.discovery attack.t1082
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022