Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects WMI queries targeting the SecurityCenter2 namespace to enumerate installed antivirus products. Attackers, such as Seedworm, use this command shortly after initial access to map out defensive tooling before deploying evasive loaders.
Detects WMI queries targeting the win32_logicaldisk class and filtering for mediatype=null. This specific query is used by Gamaredon's GammaWorm to identify network drives and removable drives (such as USBs) for malware propagation.
Detects wscript.exe querying multiple Win32 WMI classes within a short timeframe to gather host telemetry. This behavior aligns with JS.MonoGlyphRAT's pre-payload execution profiling.
Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
This rule detects suspicious command-line activity involving several Windows executables (wscript.exe, cscript.exe, wmic.exe, ssh.exe) when combined with specific keywords. It looks for wscript.exe or cscript.exe executing 'SyncAppvPublishingServer.vbs', wmic.exe executing 'process', 'call', or 'create', or ssh.exe using 'ProxyCommand'. Additionally, the rule filters for command lines containing keywords like 'gal', 'i*x', 'gcm', '*stM*', 'jsdelivr.net', 'github', or 'powershell', which are often associated with malicious activity, obfuscation, or external resource loading.
Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control.
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
This rule detects attempts to delete volume shadow copies using 'vssadmin.exe' or 'wmic.exe' with specific command-line arguments. This activity is often associated with ransomware or other destructive malware aiming to inhibit system recovery. The rule explicitly excludes commands containing 'backup' to reduce false positives.
Detects the use of wmic.exe to create a new process. This can be indicative of an adversary using WMI for execution.
Detects suspicious and uncommon child processes of WmiPrvSE
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
Detects suspicious command-line arguments used with Windows utilities (LOLBAS)
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Page 22 of 37