Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
217
107
83
74
34
Contributors
152
115
89
63
39
Categories
20,440
11,814
5,871
5,145
4,864
577
Platforms
576
8
1
1
1
Products / Services
377
207
152
92
74
MITRE Techniques
435
385
161
151
111
CVEs
1
IDS Classtypes
9
3
2
1
IDS Protocols
14
1
Detects the deletion of Windows Volume Shadow Copies using vssadmin.exe, wmic.exe, or PowerShell (WMI/CIM objects). This activity is commonly used by ransomware to prevent local data recovery by destroying shadow copy backups before encryption.
Detects the deletion of volume shadow copies using standard Windows utilities vssadmin.exe or wmic.exe. This activity is a common indicator of ransomware or other destructive attacks attempting to inhibit system recovery.
Detects host-based reconnaissance activity involving system, network, and security software enumeration using standard administrative tools (e.g., PowerShell, WMI, netsh) that is followed by an outbound network connection to a known or suspicious implant check-in endpoint within a 30-minute window.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
This rule monitors for coordinated persistence efforts by detecting the occurrence of at least two out of three specific persistence techniques (registry run key modification, scheduled task creation, or WMI-based script execution) on the same device within a 30-minute window. It explicitly filters out activities from signed binaries or those occurring in standard system/application directories, focusing on potentially malicious artifacts originating from user-writable locations.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects the WMI provider host (wmiprvse.exe) spawning common living-off-the-land binaries often associated with command execution or lateral movement.
Detects suspicious activity associated with the DarkMe RAT, specifically targeting cryptocurrency wallet data files. The rule correlates file access to known wallet data paths by a hollowed process 'clspack.exe', followed by suspicious outbound network activity originating from that same process, and potentially preceded by WMI-based antivirus enumeration.
Detects the abuse of Windows Management Instrumentation (WMI) to execute processes via wmic.exe or WmiPrvSE.exe, often combined with obfuscated command-line arguments such as encoded PowerShell or CMD commands.
Detects WmiPrvSE.exe spawning child processes within 120 seconds of a Type 3 (Network) logon event. This behavior is a common indicator of remote command execution, frequently used by lateral movement tools like Impacket's wmiexec or similar WMI-based remote execution frameworks.
Detects lateral movement techniques leveraging Windows Management Instrumentation (WMI). The rule identifies instances where the WMI provider host, WmiPrvSE.exe, spawns common administrative or interactive shell tools (e.g., cmd.exe, powershell.exe). This pattern is consistent with the abuse of Win32_Process.Create() via WMI/DCOM/RPC for remote command execution, a method frequently utilized by frameworks like Impacket (wmiexec.py) for fileless, agentless lateral movement.
Detects the creation of WMI permanent event subscriptions, including the instantiation of __EventFilter, __EventConsumer, and __FilterToConsumerBinding classes. This mechanism is frequently used by adversaries for fileless and reboot-resilient persistence, as it allows for arbitrary code execution triggered by system events.
Detects instances where the WMI Provider Host (wmiprvse.exe) spawns suspicious child processes such as cmd.exe, powershell.exe, or rundll32.exe, which are correlated with inbound network connections on ports 135 (RPC/DCOM) or 445 (SMB). This behavior is characteristic of lateral movement techniques used by tools like Impacket's wmiexec.
Detects the spawning of cmd.exe, powershell.exe, or powershell_ise.exe by the WMI Provider Host (wmiprvse.exe). This pattern is frequently used for fileless lateral movement, as threat actors leverage WMI (Win32_Process.Create) to execute remote commands which manifests as wmiprvse.exe launching a shell on the target host.
Detects coordinated activity indicative of destructive malware propagation similar to NotPetya. The rule identifies a three-stage sequence on a single host: execution of a DLL via rundll32.exe, followed by file writes to administrative network shares (C$/ADMIN$), and remote process creation via WMI (WmiPrvSE.exe), correlated with a high volume of SMB connections.
Detects potential abuse of Windows Management Instrumentation (WMI) for process execution. It monitors for wmic.exe creating processes, PowerShell cmdlets Invoke-WmiMethod or Invoke-CimMethod used for remote execution, and unexpected process spawns from the WmiPrvSE.exe provider service, which are common indicators of lateral movement and remote command execution.
Page 3 of 28