Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects repeated attempts to delete Volume Shadow Copies using WMIC. This is a common technique used by ransomware and other malware to prevent system recovery and inhibit forensic investigations. The rule filters out known backup agents and service accounts and identifies patterns where multiple distinct deletions occur within a 5-minute window.
Detects repeated attempts to delete Volume Shadow Copies using WMIC. This is a common technique used by ransomware and other malware to prevent system recovery and inhibit forensic investigations. The rule filters out known backup agents and service accounts and identifies patterns where multiple distinct deletions occur within a 5-minute window.
Detects attempts to install or modify the 'WMI Provider Host' (WmiPrvSE) service, which is a common technique used by adversaries for persistence or to masquerade malicious activity. The rule monitors process execution, registry modifications, and service installation events specifically targeting this service name.
Detects attempts to install or modify the 'WMI Provider Host' (WmiPrvSE) service, which is a common technique used by adversaries for persistence or to masquerade malicious activity. The rule monitors process execution, registry modifications, and service installation events specifically targeting this service name.
Detects anomalous system reconnaissance activity performed using WMIC or PowerShell Get-WmiObject commands. The rule tracks distinct command-line executions per device and flags hosts where three or more unique reconnaissance commands are executed within a short timeframe, which is indicative of an adversary enumerating system configuration, hotfixes, or hardware details.
Detects the execution of known offensive security tools often used for lateral movement, credential dumping, and remote code execution, such as Impacket modules and the 'Invoke-TheHash' PowerShell suite, via common command-line interpreters.
Detects the execution of known offensive security tools often used for lateral movement, credential dumping, and remote code execution, such as Impacket modules and the 'Invoke-TheHash' PowerShell suite, via common command-line interpreters.
Detects non-administrative access querying SCCM to enumerate user-device relationships, used by CISA's red team to identify which workstations belonged to high-value targets.
Detects attempts to install or modify the 'WMI Provider Host' (WmiPrvSE) service, which is a common technique used by adversaries for persistence or to masquerade malicious activity. The rule monitors process execution, registry modifications, and service installation events specifically targeting this service name.
This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.
Detects execution of a renamed Windows Contacts utility (wab.exe) spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is indicative of masquarading and process injection, commonly used by threat actors to execute arbitrary code or establish C2 communication while appearing as a legitimate Windows binary.
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Detects an AutoIt3.exe/OptiDrive.exe process performing WMI sandbox-fingerprinting queries (Win32_DiskDrive, Win32_VideoController) followed within 15 minutes by access to browser credential files, consistent with ACRStealer's anti-analysis check preceding data collection.
Detects Microsoft Defender exclusions added via wmic/MSFT_MpPreference for a fake Windows Defender installation directory used to shelter CoolClient components.
Detects remote process creation via wmic.exe/WmiPrvSE.exe and suspicious WMI event subscriptions, excluding known configuration-management platform service accounts (SCCM, Ansible, Puppet) and requiring the WMI connection to be the first-ever observed connection between the source/destination host pair.
This rule detects the use of native Windows utilities 'vssadmin.exe' and 'wmic.exe' to delete Volume Shadow Copies. This activity is a common tactic used by ransomware and other malicious actors to prevent system recovery by destroying backups, and is classified as Inhibit System Recovery.
Detects wmic.exe process enumeration ("process list"/"where") spawned within 60 seconds by a python.exe or pythonw.exe process running from a non-standard path (AppData, Temp, or ProgramData), consistent with DeviceManager RAT reconnaissance behavior delivered via the DOUBLECUP ClickFix loader.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Detects the creation or modification of WMI event subscriptions using the wmic.exe command-line utility. Adversaries utilize WMI event subscriptions for persistence by configuring event filters, consumers, and bindings that execute malicious code upon specific system events.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Page 10 of 37