Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware like MKDOOR to prevent detection.
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects a browser hijacking technique where a WMI-driven script terminates a running browser process (Chrome or Edge) and immediately restarts it with malicious command-line arguments to load an unauthorized extension.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
Detects suspicious encoded payloads in WMI Event Consumers
Detects the creation of WMI event subscriptions, which can be used as a persistence mechanism by adversaries. This rule specifically looks for Sysmon Event IDs 19 (WmiEventFilter activity), 20 (WmiEventConsumer activity), and 21 (WmiEventConsumerToFilter activity), indicating the creation or modification of WMI event filters, consumers, or their binding.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
Detects suspicious encoded payloads within WMI Event Consumers. This rule specifically looks for base64 encoded strings containing keywords commonly associated with process injection or executable characteristics, such as 'WriteProcessMemory', 'This program cannot be run in DOS mode', and 'This program must be run under Win32'. The presence of these strings in a WMI event consumer's destination property suggests an attempt to establish persistence or execute malicious code via WMI.
This rule detects PowerShell script block logging events that indicate an attempt to establish persistence using Windows Management Instrumentation (WMI) event subscriptions. Specifically, it looks for the creation of WMI event filters (`__EventFilter`) and command-line event consumers (`CommandLineEventConsumer`) within the `root/subscription` namespace, which are common components of WMI persistence techniques.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
Detects the loading of 'wbemcons.dll' by 'WmiPrvSE.exe', which is indicative of a WMI command line event consumer being used for persistence. This technique is often leveraged by adversaries to maintain access and execute code when specific WMI events occur.
This rule detects the creation of an ActiveScriptEventConsumer via the `wmic.exe` command-line utility. Adversaries often use WMI event subscriptions to establish persistence or elevate privileges by executing malicious code when a specific event occurs. The presence of 'ActiveScriptEventConsumer' and 'CREATE' in the command line indicates an attempt to set up such a subscription.
Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.
This analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It specifically detects EventID 20 (EventConsumer creation) from Sysmon logs. WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making them a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
Detects a sequence of commands associated with the anti-analysis techniques of the Stealit malware. Stealit executes specific wmic and tasklist commands in quick succession from a single parent process to check for debuggers, analysis tools, and virtual environments.
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Page 23 of 28