Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
This rule detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell. It specifically looks for multiple executions of these tools within a 5-minute window, originating from non-system accounts and not from standard Windows system directories. This behavior can indicate lateral movement or other malicious activity within a network.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Detects reconnaissance activities performed by DcRAT where svchost.exe (as an injection target) or specific suspected malicious process names launch systeminfo.exe or wmic.exe to perform OS version fingerprinting or security software enumeration, such as checking for antivirus products.
Detects the use of wmic.exe to spawn or interact with wscript.exe, which is a common pattern used by adversaries to execute scripts via WMI.
Detects the use of WMIC to query for the system's UUID. This activity is often performed by adversaries during the discovery phase to gather system information.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Detects the use of the WMIC.exe utility to execute processes on remote systems using the 'process call create' command. This technique is commonly used by adversaries for lateral movement. The rule excludes local execution scenarios.
Detects the attempt to create a process via "wmic" with the "process call create" flag, which might
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
indicate an attempt to execute a malicious process on the compromised host. Adversaries may use
wmic to execute a process on the compromised host as part of their attack. This event is triggered on
on attempt and process creation can be either successful or unsuccessful.
Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts
Detects the execution of WMIC in order to get a list of firewall and antivirus products
An adversary might use WMI to check if a certain remote service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts
Detects the removal or uninstallation of an application via "Wmic.EXE".
This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Page 19 of 37