Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
An adversary might use WMI to execute commands on a remote system
Detects specific process characteristics of Maze ransomware word document droppers
Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Attempts to detect system changes made by Blue Mockingbird
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption.
This query looks for signs of impacket wmipersist usage and should work for other wmi based persistence methods. Requires analysis.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Initial execution of malicious document calls wmic to execute the file with regsvr32
Excel called wmic to finally proxy execute regsvr32 with the payload.
An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).
But we have command-line in the event which allow us to "restore" this suspicious parent-child chain and detect it.
Monitor process creation with "wmic process call create" and LOLBins in command-line with parent Office application processes.
An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).
But we have command-line in the event which allow us to "restore" this suspicious parent-child chain and detect it.
Monitor process creation with "wmic process call create" and LOLBins in command-line with parent Office application processes.
An adversary might use WMI to execute commands on a remote system
An adversary might use WMI to check if a certain Remote Service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
Detects suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.
Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports
Detects specific process characteristics of Maze ransomware word document droppers
Blue Mockingbird
Sigma
Attempts to detect system changes made by Blue Mockingbird
Detects the execution of WMIC in order to get a list of firewall and antivirus products
Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts
Page 30 of 37