Suspicious WMIC Usage for Windows Defender Recon

Swachchhanda Shrawan Poudel (Nextron Systems)

Identifies usage of WMIC utility for Windows Defender reconnaissance. Attackers might leverage WMIC to collect data on Windows Defender settings and status to understand the security measures and defenses present. Although there are direct methods to obtain this information, using WMIC for this purpose is considered suspicious.

2025-02-13 00:00:00

None

c6f77528-c594-41b7-9142-733e5128037b

attack.discovery attack.t1518.001

Nextron Sigma feed only (private)