System profiling WMI query execution

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Execution (TA0002) Discovery (TA0007)
ATT&CK Technique	Windows Management Instrumentation (T1047) System Information Discovery (T1082)
Severity	Informational

Attackers or malware may use WMI queries to identify the system and evade execution in sandbox environments.

Attacker or malware can use WMI queries to identify system components and prevent execution in sandbox \ virtualized environments to evade detection.

Examine the process that executed the WMI query and verify that the process is from a trusted source.
Inspect the system for suspicious activity that is related to that process.