Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
44
14
12
10
3
Contributors
25
14
14
12
10
Categories
50
29
13
13
9
Platforms
87
6
Products / Services
28
23
14
11
9
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
1
IDS Classtypes
4
4
2
IDS Protocols
7
The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions.
This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries.
If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions.
This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries.
If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
Detects lateral movement techniques leveraging Windows Management Instrumentation (WMI). The rule identifies instances where the WMI provider host, WmiPrvSE.exe, spawns common administrative or interactive shell tools (e.g., cmd.exe, powershell.exe). This pattern is consistent with the abuse of Win32_Process.Create() via WMI/DCOM/RPC for remote command execution, a method frequently utilized by frameworks like Impacket (wmiexec.py) for fileless, agentless lateral movement.
Detects instances where the WMI Provider Host (wmiprvse.exe) spawns suspicious child processes such as cmd.exe, powershell.exe, or rundll32.exe, which are correlated with inbound network connections on ports 135 (RPC/DCOM) or 445 (SMB). This behavior is characteristic of lateral movement techniques used by tools like Impacket's wmiexec.
Detects network connections from workstation subnets to domain controllers using administrative protocols such as SMB (445), RPC (135), RDP (3389), or WinRM (5985/5986). This activity is indicative of lateral movement attempts by an adversary attempting to reach critical infrastructure from a compromised workstation in a flat or poorly segmented environment.
Detects remote lateral movement attempts using DCOM to launch the Microsoft Management Console (mmc.exe) via svchost.exe (RPCSS/DCOM), followed by mmc.exe spawning an unexpected child process. This pattern indicates potential remote execution and abuse of signed binary proxies for post-exploitation activities.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
This rule detects potential lateral movement attempts using DCOM-based WMI calls to the remote OXID Resolver on port 135. Attackers often abuse DCOM to remotely trigger WMI methods, enabling remote code execution, discovery, or other malicious activities. The rule triggers on the characteristic DCOM OXID Resolve packet structure associated with this activity.
Detects potential DCOM-based lateral movement by monitoring for suspicious process spawns from COM surrogates (dllhost.exe), WMI provider hosts (wmiprvse.exe), or remote invocation of office/management applications (mmc.exe, excel.exe, outlook.exe) that subsequently execute command shells or scripting interpreters.
Detects the execution of native Windows utilities (vssadmin, wmic, bcdedit) used to inhibit system recovery or modify boot configuration, such as deleting shadow copies or disabling recovery features. The rule further flags these actions when executed by suspicious parent processes, processes outside of standard system paths, or via WMI/DCOM interfaces frequently associated with ransomware and lateral movement.
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
Detects potential DCOM-based lateral movement by monitoring for suspicious process spawns from COM surrogates (dllhost.exe), WMI provider hosts (wmiprvse.exe), or remote invocation of office/management applications (mmc.exe, excel.exe, outlook.exe) that subsequently execute command shells or scripting interpreters.
Detects remote LSASS memory dumping patterns associated with the lsassy tool, leveraging comsvcs.dll to create memory dumps of the LSASS process. The rule identifies suspicious command lines involving comsvcs.dll ordinal-based exports (ordinal #+000024), tasklist enumeration for PID discovery, and subsequent dump file creation within \Windows\Temp\. It monitors remote execution methods often observed in Bumblebee and Akira campaigns, such as WMI or DCOM/MMC-based process spawning.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
Page 1 of 5