Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects blocking of process creations originating from PSExec and WMI commands
Detects successful logon attempts performed with WMI
WMI Persistence
Sigma
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects creation of WMI event subscription persistence method
Page 28 of 28