WMI System Fingerprinting

Windows Management Instrumentation (WMI) queries used by JScript/WScript droppers to harvest victim-system metadata before exfiltration. Typically queries Win32_OperatingSystem for caption, architecture, and username, and AntivirusProduct from root\SecurityCenter2 for installed AV names.

How It Works

1. `GetObject("winmgmts:\.

Detection / Fingerprint

• wscript.exe or cscript.exe spawning with command lines containing winmgmts:
• WMI namespace root\cimv2 queried for Win32_OperatingSystem
• WMI namespace root\SecurityCenter2 queried for AntivirusProduct
• Results concatenated into a plaintext report with header markers (==========) and sent via MSXML2.XMLHTTP POST

Defensive Countermeasures

• Enable WMI process creation logging (Event ID 5859/5860) to catch script-initiated WMI queries.
• Alert on wscript.exe → MSXML2.XMLHTTP → api.telegram.org (rarely legitimate).
• Block wscript.exe from untrusted .js files.

Pages Where Observed

• unclassified-js-rentry-telegram-dropper — b0c43e946344