Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
Detects WMI activity used by the BeepRAT loader to query system information (Win32_OperatingSystem, CIM_Memory), which is characteristic of virtualization and sandbox evasion techniques. The rule correlates process creation and WMI event logs with known indicators associated with BeepRAT deployment.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects BeepRAT malware exhibiting anti-analysis behavior by performing a sequence of environment-fingerprinting checks within a 60-second window. The rule monitors for a combination of registry queries targeting virtualization artifacts (VMware, VirtualBox) and WMI queries for system hardware/OS information (Win32_OperatingSystem, CIM_Memory), which are common techniques used by BeepRAT to detect virtual machines and sandboxes before execution.
Detects a Go-based backdoor associated with 'The Gentlemen' ransomware group executing commands via cmd.exe. The rule monitors for a specific pattern of WMI UUID queries alongside command-line execution of system discovery tools (whoami, net group, dir) via cmd.exe /c, which is indicative of remote command execution over a Yamux C2 channel.
Detects WMIC process creation against a remote node, which the ransomware can use as an alternative propagation method.
Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.
This rule detects suspicious process creation events where 'wsmprovhost.exe' (Windows Remote Management Provider Host) is the parent process. Wsmprovhost.exe is legitimately used for remote management via WinRM, but its child processes can indicate remote execution of commands or scripts, which is often abused by adversaries for lateral movement or execution.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) following the reconnaissance of security software or AMSI providers. It correlates WMI or registry-based discovery activities concerning security products or AMSI configurations with subsequent PowerShell-based AMSI bypass indicators (such as specific strings or method names indicative of memory patching) occurring on the same host within a 10-minute window.
Detects reconnaissance behavior associated with the KuinaExtractor tool, identified by three or more distinct WMI hardware-related queries (CPU, disk, memory, etc.) executed within a 5-minute window by a non-administrative parent process.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Detects the use of WMIC to query system information, such as BIOS, computer system, or product details. Adversaries often use this technique during the discovery phase to gather information about a target host's hardware and environment.
Detects the use of WMIC to query system information, such as BIOS, computer system, or product details. Adversaries often use this technique during the discovery phase to gather information about a target host's hardware and environment.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Page 18 of 28