Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects the use of wmic.exe to execute commands or retrieve OS information on remote systems by monitoring for the '/node:' flag in command lines. The rule excludes local host references (localhost, 127.0.0.1) to focus on remote management activity that may indicate lateral movement or remote code execution.
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Detects script querying Win32_Process for taskmgr.exe.
Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.
Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.
Correlates the ransomware utilizing WMI (Win32_Process Create) to remotely execute its copied binary on discovered lateral targets. This rule specifically looks for 'wmiprvse.exe' initiating a process where the initiating process is also 'wmiprvse.exe' and the folder path matches a common administrative share like 'Admin$' or 'C$'.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
This rule detects suspicious Windows Management Instrumentation (WMI) queries used for process and hardware enumeration. It monitors for common WMI queries that are often leveraged by malicious actors for discovery and reconnaissance, including queries for Win32_Process and Win32_Processor. It also identifies activity associated with Hannibal Stealer, specifically its use of CefSharp components to facilitate staging and process interaction.
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Detects evidence of Turla STOCKSTAY malware performing environmental keying via WMI system discovery (collecting OSVersion, MachineName, and UserName) followed by the execution of components from the specific %LOCALAPPDATA%\Programs\SMN\ directory. This behavior suggests the malware is using system-specific attributes to decrypt configuration or verify the environment before proceeding.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components that use WMI via the ManagementObjectSearcher class to perform system reconnaissance. The rule monitors for unauthorized child process spawning of WmiPrvSE.exe by identified malicious executable files, indicating active system and process information gathering.
Detects the use of WMIC to create processes on remote nodes, a technique observed with the Gentlemen ransomware for propagation. This rule specifically looks for 'wmic.exe' executions with command-line arguments indicating remote node targeting and process creation.
This rule detects the use of wmic.exe to execute commands or manage remote systems, specifically flagging indicators of lateral movement, credential usage, or command execution like 'node', 'user', 'password', and 'call create'.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects lateral movement or persistence where WMI directly spawns an RMM tool like ScreenConnect, AnyDesk, or other common remote management tools. This activity is often indicative of an attacker establishing remote access or maintaining persistence on a compromised system.
Identifies the fake VPN installer using WMI to query SecurityCenter2 to identify installed security products before unpacking the stealer. This rule specifically looks for 'wmiprvse.exe' executing with command-line arguments related to 'AntiVirusProduct' and correlates this with the execution of processes named 'GlobalProtect', 'AnyConnect', or 'VPN'.
Page 19 of 28