Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects the use of wmic.exe to execute commands or retrieve OS information on remote systems by monitoring for the '/node:' flag in command lines. The rule excludes local host references (localhost, 127.0.0.1) to focus on remote management activity that may indicate lateral movement or remote code execution.
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Detects the execution of WMIC to query information on a remote system
Detects usage of wmic to start or stop a service
Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.
Detects usage of bitsadmin downloading a file from a suspicious domain
Correlates the ransomware utilizing WMI (Win32_Process Create) to remotely execute its copied binary on discovered lateral targets. This rule specifically looks for 'wmiprvse.exe' initiating a process where the initiating process is also 'wmiprvse.exe' and the folder path matches a common administrative share like 'Admin$' or 'C$'.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
This rule detects suspicious Windows Management Instrumentation (WMI) queries used for process and hardware enumeration. It monitors for common WMI queries that are often leveraged by malicious actors for discovery and reconnaissance, including queries for Win32_Process and Win32_Processor. It also identifies activity associated with Hannibal Stealer, specifically its use of CefSharp components to facilitate staging and process interaction.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components that use WMI via the ManagementObjectSearcher class to perform system reconnaissance. The rule monitors for unauthorized child process spawning of WmiPrvSE.exe by identified malicious executable files, indicating active system and process information gathering.
Detects the use of WMIC to create processes on remote nodes, a technique observed with the Gentlemen ransomware for propagation. This rule specifically looks for 'wmic.exe' executions with command-line arguments indicating remote node targeting and process creation.
This rule detects the use of wmic.exe to execute commands or manage remote systems, specifically flagging indicators of lateral movement, credential usage, or command execution like 'node', 'user', 'password', and 'call create'.
Page 18 of 37