Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects potential DCOM-based lateral movement by monitoring for suspicious process spawns from COM surrogates (dllhost.exe), WMI provider hosts (wmiprvse.exe), or remote invocation of office/management applications (mmc.exe, excel.exe, outlook.exe) that subsequently execute command shells or scripting interpreters.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects the execution of wmic.exe with commands querying Windows Management Instrumentation (WMI) classes (AntiVirusProduct, SecurityCenter2, Win32_Product) often used by the Grandoreiro banking trojan to identify installed security software and sandbox environments. The rule specifically monitors for suspicious parent-child relationships, such as wscript.exe, cscript.exe, or mshta.exe spawning wmic.exe, especially when the originating script or binary is unsigned or originating from non-standard paths like AppData.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the use of WMI (via WmiPrvSE.exe or wmic.exe) to enumerate or terminate PowerShell processes. This behavior is indicative of the Amadey/StealC delivery chain, where a JScript dropper uses WMI to clean up script execution artifacts after a specified timeout, aiding in defense evasion.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) or command-line tool (wmic.exe) initiates potentially suspicious child processes, often indicative of lateral movement or remote command execution via WMI.
Detects potential persistence attempts via WMI event subscriptions. The rule monitors for the creation of WMI event consumers using 'wmic.exe' with suspicious command line arguments, or the use of 'mofcomp.exe' to compile MOF files by non-standard, non-Microsoft signed processes.
Detects svchost.exe or 'Mixed Reality.exe' spawning common system and security enumeration tools (such as wmic.exe, systeminfo.exe, or tasklist.exe) with command-line arguments indicative of the DcRAT 'SendInfo()' routine. This pattern is characteristic of malware performing reconnaissance of installed security software and system identification.
Detects execution of WMI queries against Win32_OperatingSystem and CIM_Memory classes by processes identified as associated with BeepRAT (e.g., HFY.exe or processes within TCC paths). This behavior is characteristic of post-infection system enumeration, hardware ID generation, and environmental keying used in operations such as DragonClone.
Detects deletion of VSS copies used by ransomware to prevent recovery
Detects Grixba infostealer activity associated with the Play Ransomware group. The rule monitors for network host and share enumeration using net.exe and WMIC, and tracks the execution of the Grixba binary GT_NET.exe from the non-standard path C:\Users\Public\Music\.
Detects remote LSASS memory dumping patterns associated with the lsassy tool, leveraging comsvcs.dll to create memory dumps of the LSASS process. The rule identifies suspicious command lines involving comsvcs.dll ordinal-based exports (ordinal #+000024), tasklist enumeration for PID discovery, and subsequent dump file creation within \Windows\Temp\. It monitors remote execution methods often observed in Bumblebee and Akira campaigns, such as WMI or DCOM/MMC-based process spawning.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.
Detects the use of wmic.exe to execute remote commands using the /node flag and the 'process call create' command string. This pattern is commonly used by adversaries for lateral movement and remote code execution.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete or resize Volume Shadow Copies. This is a common technique used by ransomware to prevent system recovery and inhibit administrative rollback of file changes.
Detects common lateral movement patterns associated with Pass-the-Hash (PtH) attacks, specifically identifying remote execution via WMI/services, the use of explicit credentials in management utilities (wmic/net), and suspicious network connections from known administration tools over lateral movement ports.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects common lateral movement patterns associated with Pass-the-Hash (PtH) attacks, specifically identifying remote execution via WMI/services, the use of explicit credentials in management utilities (wmic/net), and suspicious network connections from known administration tools over lateral movement ports.
Detects reconnaissance activities performed on compromised web servers, including the enumeration of installed security software, installed applications via WMI or registry queries, and service/process listing. These actions are often observed as a precursor to defense impairment or further exploitation originating from web server processes like w3wp.exe.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Page 13 of 37