Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects the WMI provider executing heavily encoded commands mapped to Kazuar's tasking structure for lateral movement. Specifically, it looks for 'wmiprvse.exe' initiating processes that execute PowerShell or cmd commands containing encoding indicators like 'enc' or 'FromBase64String'.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
This rule monitors for the execution of Windows utilities (vssadmin, wmic, diskshadow, wbadmin, bcdedit) with command-line arguments associated with deleting shadow copies or disabling system recovery features. This behavior is commonly observed in ransomware attacks to prevent system restoration.
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
Detects WMI queries targeting QoS policy setting data for enumeration or manipulation. This could indicate an adversary attempting to discover or modify Quality of Service policies on a system.
Detects the initialization of the NetQosCim WMI provider, an indicator of QoS policy tampering.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
Detects the execution of the 'wmi_remote_escalate.py' script, which is associated with the MuddyWater APT group for lateral movement and privilege escalation using Windows Management Instrumentation (WMI).
Detects WMI used for remote command execution in lateral movement
Local accounts, System Owner/User discovery using operating systems utilities
Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.
Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information
Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may
use wmic to terminate security products or other applications on the compromised host. This event is
triggered on on attempt and process creation can be either successful or unsuccessful.
use wmic to terminate security products or other applications on the compromised host. This event is
triggered on on attempt and process creation can be either successful or unsuccessful.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects enumeration of AV and security products via WMI
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
Page 20 of 37