Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
23
16
10
4
1
Contributors
13
10
7
6
5
Categories
49
29
14
14
10
Platforms
55
1
Products / Services
19
17
13
8
7
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
This rule detects instances where wscript.exe or cscript.exe initiate a WMI activity that specifically queries for 'Win32_Process' and contains 'taskmgr.exe' within the query. This combination can indicate an attempt to enumerate or interact with the Task Manager process via scripting, which might be indicative of malicious activity such as process hiding or manipulation.
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
Detects WMI queries targeting QoS policy setting data for enumeration or manipulation. This could indicate an adversary attempting to discover or modify Quality of Service policies on a system.
Detects the initialization of the NetQosCim WMI provider, an indicator of QoS policy tampering.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects WMI used for remote command execution in lateral movement
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Detects WMI event subscriptions used for fileless persistence
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
Detects WMI used for remote command execution in lateral movement
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Page 1 of 3