Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
This rule detects the execution of specific Windows utilities (`tree.com`, `WMIC.exe`, `doskey.exe`, `sc.exe`) when their output is redirected to a temporary file. This behavior is often associated with adversaries collecting system information or reconnaissance data for later exfiltration or analysis, as indicated by the use of `> %TEMP%\` or `> %TMP%\` in the command line.
Detects successful logon attempts that occur via the Windows Management Instrumentation (WMI) service, specifically when the WmiPrvSE.exe process is involved. This can indicate an adversary using WMI for execution or lateral movement.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicate WMI ActiveScriptEventConsumers activity. This is a common technique for persistence and privilege escalation.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
Detects an attempt to execute code or create a service on a remote host using `winrm.vbs` via `cscript.exe`. This technique leverages Windows Remote Management (WinRM) to interact with WMI for remote execution, often for lateral movement or persistence.
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Detects specific process characteristics associated with Maze ransomware droppers. This includes a temporary file being executed as a child process of WINWORD.exe, and the execution of wmic.exe to delete shadow copies, which is a common tactic for ransomware to inhibit system recovery.
Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.
Detects the execution of WMIC with the "csproduct" argument, which is used by adversaries to obtain information such as hardware models and vendor details from a system. This can be part of reconnaissance activities.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Detects the execution of WMIC to query information on a remote system, specifically looking for the '/node:' command-line argument to identify remote interactions, while filtering out local connections to 127.0.0.1 or localhost.
Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Detects when the WmiPrvSE.exe process spawns a new process. This activity can be indicative of malicious use of Windows Management Instrumentation (WMI) for execution, as WmiPrvSE.exe is a legitimate process that hosts WMI provider plug-ins. Adversaries often abuse WMI to execute commands or maintain persistence.
Page 36 of 37