Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects the creation of the default output filename used by the wmiexec tool, which is part of the Impacket toolkit. This typically indicates lateral movement or execution of commands via WMI.
Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.
This rule detects when known WMI-related modules are loaded by processes that are not typically associated with WMI operations. It specifically looks for the loading of DLLs such as 'fastprox.dll', 'wbemcomn.dll', 'wbemprox.dll', 'wbemsvc.dll', 'WmiApRpl.dll', 'wmiclnt.dll', 'WMINet_Utils.dll', 'wmiprov.dll', and 'wmiutils.dll'. The rule then filters out common legitimate processes that are known to load these WMI modules, including executables located in standard Windows directories (Program Files, System32, SysWOW64), .NET Framework paths, explorer.exe, and specific applications like WindowsAzureGuestAgent, WaAppAgent, Thor, Microsoft Defender's MsMpEng.exe, Microsoft Teams, and Sysmon. The intent is to identify potentially malicious use of WMI by uncommon or unexpected processes, which could indicate execution, persistence, or privilege escalation attempts.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.
Detects the creation of the default output filename used by the wmiexec tool
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on logs containing process details and command-line executions. This activity is significant as it may indicate suspicious behavior, such as a user or process gathering detailed process information, which is uncommon for non-technical users. If confirmed malicious, this could allow an attacker to gain insights into running processes, aiding in further exploitation or lateral movement.
Detects the artifacts generally associated with the use of wmiexec.py
Detects potential tampering with Windows Defender settings, such as adding exclusions, using the wmic.exe utility. This activity can be indicative of an adversary attempting to impair defenses to avoid detection.
The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns indicative of Impacket tool usage. This activity is significant as both Red Teams and adversaries use Impacket for remote code execution and lateral movement. If confirmed malicious, this activity could allow attackers to execute commands on remote endpoints, potentially leading to unauthorized access, data exfiltration, or further compromise of the network.
This analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. It detects these activities by analyzing process execution logs, focusing on specific command-line patterns involving `cmd.exe` executing commands against `127.0.0.1` with output redirection. This activity is significant because Impacket tools are commonly used by adversaries and Red Teams to move laterally within a network. If confirmed malicious, this could allow attackers to execute commands remotely, potentially leading to further compromise and data exfiltration.
The analytic detects the creation of shadow copies using `vssadmin.exe` or `wmic.exe`. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system. Adversaries may create shadow copies to access the NTDS.dit file for credential dumping or to exfiltrate data.
The analytic detects the use of `wmic.exe` with the `delete` command to remove an executable path. This activity often indicates an adversary attempting to disable security tools or other critical processes, facilitating further compromise and persistence within the environment, potentially for malicious activities like cryptocurrency mining.
The analytic detects the deletion of shadow copies using the vssadmin.exe or wmic.exe utilities. This activity is significant because deleting shadow copies is a common tactic used by attackers to prevent recovery and hide their tracks. If confirmed malicious, this action could hinder incident response efforts and allow attackers to maintain persistence and cover their activities, making it crucial for security teams to investigate promptly.
This analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. This activity is significant as it often indicates lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes spawned by `wmiprvse.exe` with command-line patterns indicative of Impacket usage. This activity is significant as Impacket tools are commonly used by adversaries for remote code execution and lateral movement within a network. If confirmed malicious, this could allow attackers to execute arbitrary commands on remote systems, potentially leading to further compromise and data exfiltration.
The following analytic detects the creation of shadow copies using "wmic" or "Powershell" commands. It leverages the Endpoint.Processes data model in Splunk to identify processes where the command includes "shadowcopy" and "create". This activity is significant because it may indicate an attacker attempting to manipulate or access data in an unauthorized manner, potentially leading to data theft or manipulation. If confirmed malicious, this behavior could allow attackers to backup and exfiltrate sensitive data or hide their tracks by restoring files to a previous state after an attack.
This analytic detects the execution of `mofcomp.exe` loading a MOF file, particularly when initiated by `cmd.exe` or `powershell.exe`, or when `mofcomp.exe` is executed from unusual paths such as user profile directories (`*\AppData\Local\*` or `*\Users\Public\*`). This activity is significant because adversaries often use WMI for persistence or lateral movement. Successful exploitation could lead to arbitrary code execution, persistence, or privilege escalation within the environment.
Page 33 of 37