Process Enumeration via WMI

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell commands that use WMI to enumerate processes via the Win32_Process class. Threat actors may use this technique during post-exploitation to inspect running process arguments, which may reveal credentials, configuration details, or identify defensive tools for further targeting.

2026-09-03 00:00:00

None

a4f7c8e2-3b1d-4e9a-8f2c-7d5b6a9e0f3c

attack.discovery attack.t1057 attack.execution attack.t1047

Nextron Sigma feed only (private)