Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Generic rule content from file: TOKYOCORE Lateral Movement via WMIC Remote Process Creation (/node:)
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects the use of built-in Windows utilities, specifically 'wmic.exe' and 'vssadmin.exe', to delete volume shadow copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to query system manufacturer or model information. This behavior is commonly employed by malware as an anti-virtualization or anti-sandbox technique to identify if it is running in a virtual machine environment by checking for known hypervisor-related strings in hardware identifiers.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.
Detects the execution of systeminfo.exe or wmic.exe that terminates within 5 seconds. This behavior is indicative of automated environment or sandbox discovery techniques, often performed by malware loaders such as those associated with the Turb00 operation or similar campaigns to fingerprint the victim machine prior to executing malicious payloads.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
Detects the use of native Windows administration utilities (vssadmin, wbadmin, bcdedit, wmic, powershell) to delete shadow copies, modify boot configurations to disable recovery, or remove backup catalogs, a behavior typically performed by ransomware groups like The Gentlemen to prevent system recovery.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects anomalous activity where multiple distinct Living-off-the-Land (LotL) binaries (e.g., powershell.exe, cmd.exe, wmic.exe, tasklist.exe, systeminfo.exe) are executed on the same device within a single hour. This threshold of 4 unique administrative or discovery tools being used in a short timeframe is often indicative of reconnaissance, lateral movement, or post-exploitation environment assessment by an adversary.
Page 11 of 37