Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.
Detects the execution of the RustyWater implant payload "CertificationKit.ini" from the "C:\ProgramData" directory. This activity is associated with the MuddyWater APT group.
Detects Windows Management Instrumentation (WMI) queries performed by wscript.exe that include specific reconnaissance-related keywords such as 'Win32_OperatingSystem', 'Win32_Process', 'LastBootUpTime', and 'PROCESSOR_ARCHITECTURE'. This activity is indicative of system reconnaissance, potentially by malware like Turla Kazuar v3 VBScript loader.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects a suspicious child process of Script Event Consumer (scrcons.exe).
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Detects suspicious encoded payloads in WMI Event Consumers
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects suspicious encoded payloads within WMI Event Consumers. This rule specifically looks for base64 encoded strings containing keywords commonly associated with process injection or executable characteristics, such as 'WriteProcessMemory', 'This program cannot be run in DOS mode', and 'This program must be run under Win32'. The presence of these strings in a WMI event consumer's destination property suggests an attempt to establish persistence or execute malicious code via WMI.
This rule detects attempts to modify system services or WMI settings, which are behaviors associated with the Blue Mockingbird cryptominer. Specifically, it looks for 'sc config' commands that include 'wercplsupporte.dll' and 'wmic.exe' commands ending with 'COR_PROFILER'. These command-line patterns indicate potential persistence or defense evasion mechanisms used by the threat.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behavior could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. This action can be used by adversaries to maintain persistence on a compromised account by preventing its password from expiring, thus avoiding the need to frequently update credentials.
This rule detects the creation of an ActiveScriptEventConsumer via the `wmic.exe` command-line utility. Adversaries often use WMI event subscriptions to establish persistence or elevate privileges by executing malicious code when a specific event occurs. The presence of 'ActiveScriptEventConsumer' and 'CREATE' in the command line indicates an attempt to set up such a subscription.
Detects the modification of a registry value under `\Software\Winternals\BGInfo\UserFields\` where the `Details` field starts with '6', indicating a custom WMI query. This activity can be abused by adversaries to execute arbitrary WMI queries via BgInfo.exe, potentially leading to persistence or defense evasion.
Page 24 of 37