Installed software inventory enumerated from the command line

Siemphony@siemphonylowT1518unverified

Matches the Windows leg of AN1100 in the form one process-creation record can carry: a command line naming the WMI/CIM classes that list installed products, the PowerShell package cmdlets, or the Uninstall registry subtree that every general-purpose software inventory actually reads. The Uninstall arm is a plain substring on the key path, so it covers `reg query`, `Get-ItemProperty HKLM:\...\Uninstall\*` and a WMI StdRegProv call alike without guessing at the tool; the `wmic.exe` arm is separate because `wmic product get` never contains the string `Win32_Product` and would otherwise be missed, and its alias carries a leading space so that a Security Center query such as `wmic ... path AntiVirusProduct get` does not fall through it. AN1100's second log source, the PowerShell operational log, is not used here: a cmdlet typed into a session already running, or called from inside a script, never reaches a process command line at all, so that half of the analytic needs its own 4104 rule with Script Block Logging switched on. This is the parent technique's own observable and it is disjoint from the published T1518.001 rule, which gates on security-vendor and Security Center names — a query for every installed product is not a query for the AV agent, and neither rule's value list appears in the other. What is not attempted: MITRE's `TimeWindow` knob asks for several discovery commands inside a short window, which needs an aggregation lib/sigma does not model, and the `ParentProcess` knob is left unused rather than turned into a filter, because the management tools it would exclude are exactly what an adversary living off the land would run through. The Linux arm AN1101 (`dpkg -l`, `rpm -qa` on auditd) and the macOS arm AN1102 (`system_profiler` on the unified log) are different feeds with different field vocabularies and belong in their own rules, not bolted onto this logsource. Prerequisite: the brief feeds this Sysmon-shaped `process_creation` category from Security EventID 4688, which needs *Audit Process Creation*, and every arm of this rule reads `CommandLine`, which needs the separate *Include command line in process creation events* policy — without that second policy the rule matches nothing at all, and zero rows reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0392, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "Win32_Product" or ProcessCommandLine contains "Win32_InstalledWin32Program" or ProcessCommandLine contains "Win32_InstalledStoreProgram" or ProcessCommandLine contains "Win32_SoftwareElement" or ProcessCommandLine contains "Win32_SoftwareFeature") or ProcessCommandLine contains "\\CurrentVersion\\Uninstall" or (ProcessCommandLine contains "Get-Package" or ProcessCommandLine contains "Get-AppxPackage" or ProcessCommandLine contains "Get-AppvClientPackage" or ProcessCommandLine contains "Get-WindowsCapability" or ProcessCommandLine contains "Get-InstalledModule") or (FolderPath endswith "\\wmic.exe" and ProcessCommandLine contains " product"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*Win32_Product*" OR CommandLine="*Win32_InstalledWin32Program*" OR CommandLine="*Win32_InstalledStoreProgram*" OR CommandLine="*Win32_SoftwareElement*" OR CommandLine="*Win32_SoftwareFeature*") OR CommandLine="*\\CurrentVersion\\Uninstall*" OR (CommandLine="*Get-Package*" OR CommandLine="*Get-AppxPackage*" OR CommandLine="*Get-AppvClientPackage*" OR CommandLine="*Get-WindowsCapability*" OR CommandLine="*Get-InstalledModule*") OR (Image="*\\wmic.exe" AND CommandLine="* product*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*win32_product*" OR TO_LOWER(process.command_line) LIKE "*win32_installedwin32program*" OR TO_LOWER(process.command_line) LIKE "*win32_installedstoreprogram*" OR TO_LOWER(process.command_line) LIKE "*win32_softwareelement*" OR TO_LOWER(process.command_line) LIKE "*win32_softwarefeature*") OR TO_LOWER(process.command_line) LIKE "*\\\\currentversion\\\\uninstall*" OR (TO_LOWER(process.command_line) LIKE "*get-package*" OR TO_LOWER(process.command_line) LIKE "*get-appxpackage*" OR TO_LOWER(process.command_line) LIKE "*get-appvclientpackage*" OR TO_LOWER(process.command_line) LIKE "*get-windowscapability*" OR TO_LOWER(process.command_line) LIKE "*get-installedmodule*") OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND TO_LOWER(process.command_line) LIKE "* product*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Win32_Product|Win32_InstalledWin32Program|Win32_InstalledStoreProgram|Win32_SoftwareElement|Win32_SoftwareFeature)</field>    <description>Installed software inventory enumerated from the command line (1/4)</description>    <mitre>      <id>T1518</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)\\CurrentVersion\\Uninstall</field>    <description>Installed software inventory enumerated from the command line (2/4)</description>    <mitre>      <id>T1518</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-Package|Get-AppxPackage|Get-AppvClientPackage|Get-WindowsCapability|Get-InstalledModule)</field>    <description>Installed software inventory enumerated from the command line (3/4)</description>    <mitre>      <id>T1518</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i) product</field>    <description>Installed software inventory enumerated from the command line (4/4)</description>    <mitre>      <id>T1518</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 745c287c-0985-4b76-9c78-e4cdd66e80d3

ATT&CKT1518

T1518Software Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN1100 describes an adversary spawning a process or script to enumerate installed software through WMI, the registry or PowerShell. This rule implements the Windows leg in the form a single process-creation record can carry: a command line that names an inventory WMI class, a package cmdlet, the Uninstall registry subtree, or wmic ... product. Two boundaries are worth stating up front. This is the parent technique's observable — a query for every installed product, not a query for the AV agent, which is the published T1518.001 rule's material. And it sees command lines only: an implant that walks the Uninstall subtree with RegEnumKeyEx in-process, or queries Win32_Product through IWbemServices without shelling out, leaves no matching record at all. The realistic surface is scripted or hands-on-keyboard inventory.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1100. The brief feeds that Sysmon-shaped category from Security EventID 4688, so it needs Audit Process Creation — and every arm reads CommandLine, which needs the separate Include command line in process creation events policy. Without that second policy the rule matches nothing whatsoever.
AN1100's second log source, the PowerShell operational log, is not used here. A cmdlet typed into a session already running, or called from inside a .ps1, never reaches a process command line, so that half of the analytic needs its own 4104 rule with Script Block Logging enabled. All four backends render this one.

03 · How the logic works

Four independent selections, condition: 1 of selection*. selection_wmi_class matches five class names — Win32_Product, Win32_InstalledWin32Program, Win32_InstalledStoreProgram, Win32_SoftwareElement, Win32_SoftwareFeature. selection_uninstall_key is a single substring, \CurrentVersion\Uninstall, deliberately tool-agnostic: it covers reg query, Get-ItemProperty HKLM:\...\Uninstall\* and a StdRegProv call without anyone guessing which binary was used. selection_wmic_product is the one to study. It ANDs Image|endswith: '\wmic.exe' with CommandLine|contains: ' product' — and the leading space is load-bearing. wmic product get never contains the string Win32_Product, so it needs its own arm; but an unanchored product also matches AntiVirusProduct, AntiSpywareProduct and FirewallProduct, which are SecurityCenter2 class names belonging to T1518.001. The space keeps wmic product list brief and drops all three. selection_package_cmdlet lists Get-Package, Get-AppxPackage, Get-AppvClientPackage, Get-WindowsCapability and Get-InstalledModule. The last three stretch past software inventory into store-app deprovisioning, feature compliance and module management — useful, but this is the arm to delete first. MITRE's TimeWindow knob (several discovery commands in one window) needs an aggregation lib/sigma does not model. Its ParentProcess knob is left unused rather than turned into a filter, because the management tools it would exclude are exactly what an adversary living off the land runs through.

04 · Common false positives

Constantly, and honestly so — hence level: low. Software asset management and vulnerability scanning dominate: SCCM hardware inventory, Intune, Lansweeper, PDQ and the Qualys, Tenable and Rapid7 agents all read these exact classes and the Uninstall subtree on a schedule. Behind them, MSI installers and vendor updaters check Uninstall for a previous version before installing over it, so ordinary patching matches per package. Administrators troubleshooting run wmic product get name,version as a first step. The cmdlet arm adds image-build and MDM baseline scripts.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. Nothing above has been measured; it is reasoning about YAML.
tier_2: run read-only, rank matches by `Image` and `ParentImage`, and build the exclusion from what actually lands.
tier_3: ** stop alerting on the single command and correlate several discovery techniques in MITRE's TimeWindow, which is where this rule was always meant to end up.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude your inventory agents by ParentImage or Image before anything else;
Drop Get-AppxPackage, Get-WindowsCapability and Get-InstalledModule if
Do not raise the level to compensate. The correct promotion is context —

Declared by the author

Software asset management and vulnerability scanning. SCCM/Configuration Manager hardware inventory, Intune, Lansweeper, PDQ and the Qualys, Tenable and Rapid7 agents all enumerate installed products on a fixed schedule, through these exact classes and the Uninstall subtree. On a managed fleet this is the dominant volume by a wide margin and is the reason this rule is low rather than medium.
Installer, updater and uninstall workflows. MSI-based setups, patch tools and vendor updaters read the Uninstall subtree to find a previous version before installing over it, so ordinary software maintenance produces a matching command line per package.
Administrator and help-desk troubleshooting, where wmic product get name,version and Get-Package are the standard first step for confirming what is installed on a machine before a support call.
Build and provisioning tooling: Get-WindowsCapability in feature-compliance scripts, Get-AppxPackage in the deprovisioning scripts that image builds and MDM baselines run on every new machine, and Get-InstalledModule in the PowerShell module-update step of a CI or configuration-management run.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-wmic-inventory
Asset inventory agent querying installed products via WMI.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Installed software version read from the registry
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1518, evaluated against their process_creation events.

Share this rule

/u/siemphony/745c287c-0985-4b76-9c78-e4cdd66e80d3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Installed software inventory enumerated from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it