Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete or resize Volume Shadow Copies. This is a common technique used by ransomware to prevent system recovery and inhibit administrative rollback of file changes.
Detects the execution of wmic.exe with command-line arguments related to hardware enumeration (e.g., system, BIOS, memory, video controller information) which are commonly used by malware for sandbox evasion and VM fingerprinting. The rule specifically alerts when these commands are spawned by processes running from suspicious temporary directories or staging paths often associated with malware droppers.
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects the creation or modification of Windows Management Instrumentation (WMI) event subscriptions (filters, consumers, and bindings) that target potentially malicious destinations like cmd.exe, PowerShell, or files located in common user-writable directories like Temp or AppData, or multiple concurrent WMI subscription activities which may indicate persistence mechanisms.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
This rule detects potential lateral movement attempts using DCOM-based WMI calls to the remote OXID Resolver on port 135. Attackers often abuse DCOM to remotely trigger WMI methods, enabling remote code execution, discovery, or other malicious activities. The rule triggers on the characteristic DCOM OXID Resolve packet structure associated with this activity.
Detects potential DCOM-based lateral movement by monitoring for suspicious process spawns from COM surrogates (dllhost.exe), WMI provider hosts (wmiprvse.exe), or remote invocation of office/management applications (mmc.exe, excel.exe, outlook.exe) that subsequently execute command shells or scripting interpreters.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects the execution of native Windows utilities (vssadmin, wmic, bcdedit) used to inhibit system recovery or modify boot configuration, such as deleting shadow copies or disabling recovery features. The rule further flags these actions when executed by suspicious parent processes, processes outside of standard system paths, or via WMI/DCOM interfaces frequently associated with ransomware and lateral movement.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) or command-line tool (wmic.exe) initiates potentially suspicious child processes, often indicative of lateral movement or remote command execution via WMI.
Detects the creation or modification of Windows Management Instrumentation (WMI) event subscriptions (filters, consumers, and bindings) that target potentially malicious destinations like cmd.exe, PowerShell, or files located in common user-writable directories like Temp or AppData, or multiple concurrent WMI subscription activities which may indicate persistence mechanisms.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) spawns a command shell (cmd.exe) with command-line arguments involving standard output redirection (2>&1), often used to capture error and output streams in remote command execution scenarios. This pattern is commonly observed during lateral movement or remote administration activity.
Detects the use of the built-in Windows rundll32.exe utility to call the MiniDump function within comsvcs.dll, a known technique for dumping the memory contents of the Local Security Authority Subsystem Service (LSASS). The rule specifically flags executions that write to the Windows\Temp directory, which is a common indicator of unauthorized credential harvesting attempts.
Page 12 of 37