Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
This rule detects potential ransomware activity by monitoring for the deliberate inhibition of Windows system recovery features (via vssadmin, wmic, or bcdedit) and the subsequent staging of archived data in public user directories.
Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Detects execution of the AdaptixC2 agent (AdgNsy.exe), anomalous WMI lateral movement (WmiPrvSE.exe spawning processes from AppData\Local), and suspicious outbound network connections from AppData\Local processes to non-standard ports.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
Detects the execution of a renamed Windows Address Book (WAB.exe) binary, observed as AdgNsy.exe, originating from an AppData local directory and spawned by WmiPrvSE.exe. This pattern is indicative of AdaptixC2 beaconing activity, leveraging WMI for execution to maintain persistence or conduct remote operations under the guise of a legitimate system utility.
This rule detects lateral movement activity associated with the Impacket toolkit. It monitors for the execution of common Impacket scripts (e.g., psexec.py, smbexec.py, wmiexec.py) or binaries (psexec.exe/PsExec64.exe) spawning from suspicious parent processes or interacting with sensitive Windows shares (ADMIN$, IPC$). Additionally, it flags Python processes performing SMB connections to multiple internal hosts, as well as cmd.exe/powershell.exe instances spawned from services.exe that reference Impacket tool names in their command lines.
This rule detects the use of 'wmic.exe', 'powershell.exe', or 'pwsh.exe' to interact with WMI event consumers (ActiveScriptEventConsumer or CommandLineEventConsumer) and filter bindings. Adversaries use these WMI components to establish persistence by executing malicious code when specific system events occur, such as a process start or a scheduled time trigger.
This rule detects the use of 'wmic.exe', 'powershell.exe', or 'pwsh.exe' to interact with WMI event consumers (ActiveScriptEventConsumer or CommandLineEventConsumer) and filter bindings. Adversaries use these WMI components to establish persistence by executing malicious code when specific system events occur, such as a process start or a scheduled time trigger.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Detects WMIC XSL script processing for LOLBin code execution
Detects signs of Grixba malware activity, including process execution of Gt_net.exe from the Public/Music directory, associated WMI/WinRM remote network connections, and the creation of staging artifacts such as data.zip or ExportData.db.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Detects instances where svchost.exe (typically a system service host) is acting as the parent process to spawn reconnaissance utilities such as systeminfo.exe, wmic.exe, ipconfig.exe, or whoami.exe. This behavior is highly irregular as these utilities are typically invoked by users or administrative scripts, not system-level service processes, and may indicate process injection or malicious activity leveraging legitimate system processes.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
This rule detects potentially malicious reconnaissance and execution activity. On Linux, it monitors for network and system information discovery utilities (e.g., ifconfig, netstat, ip) executed by shells or remote access daemons. On Windows, it monitors for the use of WScript, CScript, WMIC, and WBEMTest in potentially suspicious ways, including the use of WMI for command execution.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
Page 14 of 37