Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,704
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects the use of built-in Windows utilities, specifically 'wmic.exe' and 'vssadmin.exe', to delete volume shadow copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Detects the use of WMIC to rename a local administrator account to 'NO ESCAPE'. This behavior is associated with the NoEscape ransomware, which renames the built-in administrator account to 'NO ESCAPE' as part of its post-compromise activity.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to query system manufacturer or model information. This behavior is commonly employed by malware as an anti-virtualization or anti-sandbox technique to identify if it is running in a virtual machine environment by checking for known hypervisor-related strings in hardware identifiers.
Detects the use of PowerShell to execute WMI queries against the Win32_ComputerSystem class to identify domain membership information. This is a common discovery technique used by attackers to profile the environment and understand network context.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.
The analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.
Detects the use of native Windows administration utilities (vssadmin, wbadmin, bcdedit, wmic, powershell) to delete shadow copies, modify boot configurations to disable recovery, or remove backup catalogs, a behavior typically performed by ransomware groups like The Gentlemen to prevent system recovery.
Detects the Yuta/Glove stealer malware performing sandbox and virtualization environment evasion. The rule specifically monitors for the process 'winupdate.exe' attempting to query common registry keys associated with virtualization software (VMware, VirtualBox, VBOX, QEMU) and executing WMI commands to enumerate system manufacturer information via 'wmic.exe'. These actions are commonly used by malware to detect if it is executing within an analysis sandbox or VM to abort or alter its behavior.
Detects wscript.exe or cscript.exe executing VBScript to query WMI classes (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor) or 'Basic System' information. This activity is often used for host reconnaissance and fingerprinting by threat actors prior to C2 check-in, notably observed in Kimsuky multi-stage tradecraft.
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete or resize Volume Shadow Copies. This is a common technique used by ransomware to prevent system recovery and inhibit administrative rollback of file changes.
Page 10 of 25