Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
575 detections
Filters
Last updated
All Time
Detection languages
217
107
81
74
34
Contributors
152
115
89
61
39
Categories
20,437
11,828
5,871
5,150
4,864
575
Platforms
574
8
1
1
1
Products / Services
376
206
152
92
74
MITRE Techniques
435
385
161
149
109
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects blocking of process creations originating from PSExec and WMI commands
Detects successful logon attempts performed with WMI
WMI Persistence
Sigma
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects creation of WMI event subscription persistence method
Page 28 of 28