Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Detects reconnaissance activities performed by DcRAT where svchost.exe (as an injection target) or specific suspected malicious process names launch systeminfo.exe or wmic.exe to perform OS version fingerprinting or security software enumeration, such as checking for antivirus products.
Detects WMI reconnaissance commands targeting the SecurityCenter2 namespace (e.g., AntiVirusProduct, FirewallProduct) or system information (e.g., Win32_OperatingSystem) executed via wmic.exe, powershell.exe, or pwsh.exe. This activity is consistent with post-exploitation reconnaissance techniques utilized by DcRAT malware as observed in Operation DragonReturn.
Detects the use of wmic.exe to spawn or interact with wscript.exe, which is a common pattern used by adversaries to execute scripts via WMI.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Detects the use of the WMIC.exe utility to execute processes on remote systems using the 'process call create' command. This technique is commonly used by adversaries for lateral movement. The rule excludes local execution scenarios.
This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects the WMI provider executing heavily encoded commands mapped to Kazuar's tasking structure for lateral movement. Specifically, it looks for 'wmiprvse.exe' initiating processes that execute PowerShell or cmd commands containing encoding indicators like 'enc' or 'FromBase64String'.
Detects the loading of the QoS WMI provider DLL (qoswmi.dll) into the WMI provider host (wmiprvse.exe). This behavior is associated with the EDRChoker technique, which can be used for stealthy execution and EDR evasion.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
Detects WMI queries targeting QoS policy setting data for enumeration or manipulation. This could indicate an adversary attempting to discover or modify Quality of Service policies on a system.
Detects the initialization of the NetQosCim WMI provider, an indicator of QoS policy tampering.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Page 20 of 28