Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
59
43
23
12
4
Contributors
36
29
18
15
10
Categories
109
81
55
26
14
Platforms
149
1
1
Products / Services
73
37
25
19
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.
Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.
The following analytic detects the execution of MOFComp.exe loading a MOF file, often triggered by cmd.exe or powershell.exe, or from unusual paths like User Profile directories. It leverages Endpoint Detection and Response (EDR) data, focusing on process names, parent processes, and command-line executions. This activity is significant as it may indicate an attacker using WMI for persistence or lateral movement. If confirmed malicious, it could allow the attacker to execute arbitrary code, maintain persistence, or escalate privileges within the environment.
Detects a potential WMI-based persistence mechanism by identifying the sequential execution of mofcomp.exe to compile a MOF file located in a temporary directory, followed by the execution of a VBScript payload using cscript.exe with the /e:VBScript.Encode flag. This pattern is indicative of an attacker attempting to establish persistence via WMI event subscriptions.
Detects instances where a process contacts multiple distinct AI-provider domains within a short time frame while simultaneously performing suspicious operations, such as accessing the LSASS memory, executing process injection, or establishing WMI persistence. This pattern is indicative of a potential 'ClosedQuorum' adversary behavior involving data exfiltration or AI-assisted malicious activity.
Detects the creation or modification of WMI Event Subscriptions (Filters, Consumers, and Bindings) using administrative tools like wmic, powershell, or mofcomp. This behavior is commonly used by adversaries to establish persistence or facilitate execution via WMI event triggers.
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
Detects the creation of WMI permanent event subscriptions, including the instantiation of __EventFilter, __EventConsumer, and __FilterToConsumerBinding classes. This mechanism is frequently used by adversaries for fileless and reboot-resilient persistence, as it allows for arbitrary code execution triggered by system events.
Detects the creation of WMI event subscriptions via wmic.exe, PowerShell, or the compilation of MOF files. These techniques are commonly used by adversaries to establish persistence or execute malicious payloads by binding event filters to event consumers.
Detects the creation of Windows Management Instrumentation (WMI) Event Filter, Event Consumer, or FilterToConsumerBinding objects. Attackers use these objects to create event subscriptions that trigger malicious code or scripts upon specific system events, providing a stealthy and persistent execution mechanism.
Detects unauthorized or suspicious use of Windows Management Instrumentation (WMI) for lateral movement and remote code execution. The rule monitors for common WMI exploitation vectors, including the use of wmic.exe for process creation, PowerShell or C# invocations of WMI/CIM methods (such as Win32_Process Create), WMI event subscription registration for persistence, and the execution of mofcomp.exe.
Detects the compilation of a Managed Object Format (MOF) file using mofcomp.exe from the temporary directory of the MSSQL service account. This behavior is indicative of an attacker leveraging the xp_cmdshell procedure in MSSQL to deploy a malicious MOF file, which registers a WMI permanent event subscription to establish persistence or facilitate secondary payload execution.
Detects anomalous attempts to silently reinstall an APK or modify accessibility settings via a local ADB shell daemon (identified by specific local-service file paths). This behavior is characteristic of Android malware, such as RatHat, attempting to maintain persistence and gain unauthorized permissions.
Detects the creation of permanent WMI event subscriptions which can be used by adversaries to establish persistence by triggering malicious code execution upon specific system events. The rule monitors Sysmon events 19, 20, and 21 as well as Microsoft-Windows-WMI-Activity logs for modifications involving Event Filters, Consumers, and Bindings, specifically looking for CommandLineEventConsumer or ActiveScriptEventConsumer.
Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.
Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.
This rule detects potential remote command execution using Windows Management Instrumentation (WMI) via wmic.exe or PowerShell, as well as suspicious child processes spawned by the WMI provider host (wmiprvse.exe). It monitors for command lines utilizing the /node switch to target remote systems or invoking WMI methods to trigger execution, which are common patterns for lateral movement.
Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.
Detects the creation of WMI event filters and consumers associated with CommandLineEventConsumer or ActiveScriptEventConsumer, excluding known legitimate system processes. This behavior is a common technique for establishing persistence and executing arbitrary code via WMI event subscriptions.
Page 1 of 8