Create proc_creation_win_wmic_system_info_discovery.yml

[tropChaud]

No description provided.

[phantinuss]

One could try to write the rule with specific commands used by specific malware variants. I am unsure about the FPs which might still occur there but it should be less than for a generic rule.

Video games wouldn't be my biggest concern as they already are the source of many FPs and normally there shouldn't be games on corporate machines. But right now some detection strings don't look suspicious, even for a medium level rule and I can see them used by just any legitimate software.

We could put the rule through our internal testing and see if something sticks but I suspect many more FPs in the wild. Recon can be hard to detect without FPs :/

[tropChaud]

Thanks. The variant observed so far seems to use only three of the commands (os get Caption, path win32_VideoController get name, cpu get name), executed in immediate succession (within ~1 second). Maybe the idea of a correlation-based rule makes the most sense? And if so we can wait for the new notation to be released.

[nasbench]

After thinking a bit about it. I would say we could test the rule in its current form and see the results. If too many FPs arise we simply reduce it to low or remove the CLIs generating a lot of FPs and in the future we add a variation using correlations.

[phantinuss]

Agreed. As medium we can try.