Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
This rule detects the exfiltration or beaconing of host profiling information, including security software, browser, UAC, hardware (CPU/RAM), and domain details, by the LabubaRAT remote access tool over a proxy or web-based connection.
This rule detects potential security software discovery attempts by monitoring for access to Windows Registry keys associated with installed software (Uninstall keys) and Windows Defender configurations. Adversaries often query these registry locations to identify security products installed on a host to determine if they need to disable them, avoid them, or modify their behavior to evade detection.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.
Detects the execution of common Windows system utilities (tasklist.exe, sc.exe, reg.exe, wmic.exe, powershell.exe) with command-line arguments indicative of security software, antivirus product, or system service enumeration. This activity is frequently associated with reconnaissance efforts by threat actors attempting to identify defensive capabilities.
Detects the BQT/start.exe loader exhibiting suspicious behavior indicative of sandbox or analysis environment evasion, including checking for common analysis tools, enumerating processes, or querying the registry for VMware-related artifacts.
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
Detects the enumeration of installed security and monitoring software, such as Sysmon, Filebeat, and Microsoft Defender, using common system administration tools including sc.exe, tasklist.exe, wmic.exe, PowerShell, and reg.exe. This activity is often associated with reconnaissance performed prior to disabling security features on a compromised host.
Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.
Detects reconnaissance activities where an adversary attempts to identify installed security software (AV, EDR, logging tools) on a Windows host. The rule identifies the execution of common discovery commands including PowerShell Get-MpComputerStatus, wmic, sc query, tasklist, and reg query targeting specific security process names and registry paths.
Detects the DcRAT malware implant executing svchost.exe as a child process of 'Mixed Reality.exe', a behavior used during the malware's SendInfo phase to enumerate security products and prepare for AMSI patching.
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Page 3 of 8