Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects attempts to enumerate security products on a target system via Remote WMI over SMB (port 445). It specifically looks for the string "AntiVirusProduct" in TCP traffic directed to port 445, indicating a potential query for installed antivirus software. This activity is often associated with discovery tactics used by attackers to understand the security posture of a compromised system or network.
This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.
Detects wscript.exe executing WMI queries targeting specific Win32 classes (such as Win32_SystemEnclosure, Win32_VideoController, etc.) to profile the host system. This behavior is associated with JS.MonoGlyphRAT, which extensively profiles systems before deploying secondary payloads.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects WMI queries targeting the win32_logicaldisk class and filtering for mediatype=null. This specific query is used by Gamaredon's GammaWorm to identify network drives and removable drives (such as USBs) for malware propagation.
Detects wscript.exe querying multiple Win32 WMI classes within a short timeframe to gather host telemetry. This behavior aligns with JS.MonoGlyphRAT's pre-payload execution profiling.
Detects the creation of WMI Event Subscriptions containing the 'WinUpdate' string via PowerShell. This is a known persistence pattern used by Silent Stealer to masquerade its mechanisms as legitimate Windows Update tasks and survive system reboots.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
Detects a specific WMI query used by malware, such as Gamaredon's GammaWorm, to discover network drives (e.g., SMB mounts) and low-cost USB drives for malware propagation by filtering for mediatype=null.
Detects modification of Windows Boot Configuration Data (BCD) to enable SafeBoot (Minimal or Network) via WMI methods. This technique is commonly used by attackers to reboot the system into Safe Mode where EDR and AV kernel drivers are not loaded.
Detects the use of wmic.exe to create a new process. This can be indicative of an adversary using WMI for execution.
Detects the creation of WMI event consumers associated with the Dragon Boss AV killer, specifically looking for names containing 'MbRemovalMbSetupKillConsumer'. This mechanism is actively used by this campaign to ensure immediate termination of AV setup processes upon system boot.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Detects WMI abuse for lateral movement, remote execution, and persistence.
Using native WMI, and one condition for PowerShell plus WMI queries
Using native WMI, and one condition for PowerShell plus WMI queries
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects WMI executing script engines as possible persistence mechanism
This rule detects activities associated with the XWorm LATAM campaign. It identifies network indicators such as specific C2 domains (jholycf100.ddns.com.br, voulerlivros.com.br, res.cloudinary.com), a specific IP address (152.249.17.145), and a destination port (7000). It also looks for the abuse of CasPol.exe making outbound connections to the identified C2 infrastructure. Furthermore, the rule detects PowerShell processes spawned by WMI (WmiPrvSE.exe) that attempt to fetch content from Cloudinary and load assemblies in memory, indicating potential in-memory execution. Finally, it includes a specific SHA256 file hash (7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5) associated with the campaign.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
Detects a Windows Script Host process (wscript.exe or cscript.exe) using WMI to spawn a PowerShell process. This technique is used by malware, such as in the Remcos RAT delivery chain, to break the parent-child process relationship and evade detections based on process ancestry.
Page 22 of 28