Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects common lateral movement patterns associated with Pass-the-Hash (PtH) attacks, specifically identifying remote execution via WMI/services, the use of explicit credentials in management utilities (wmic/net), and suspicious network connections from known administration tools over lateral movement ports.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects common lateral movement patterns associated with Pass-the-Hash (PtH) attacks, specifically identifying remote execution via WMI/services, the use of explicit credentials in management utilities (wmic/net), and suspicious network connections from known administration tools over lateral movement ports.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects information stealer malware, such as LokiBot or StealC, attempting to enumerate installed security software, firewall configurations, and system services. The rule monitors for WMI queries to 'SecurityCenter2' or registry enumeration of uninstallation/service keys originating from processes executing within user-writable, high-risk directories such as Temp, Downloads, or ProgramData, while filtering out known legitimate system processes.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Detects the use of WMIC to interact with the MSFT_MpPreference WMI namespace to add folder or file extension exclusions to Microsoft Defender. This technique is often used by attackers to exempt malicious files or tools from being scanned by security software.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.
Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects execution of the AdaptixC2 agent (AdgNsy.exe), anomalous WMI lateral movement (WmiPrvSE.exe spawning processes from AppData\Local), and suspicious outbound network connections from AppData\Local processes to non-standard ports.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects the execution of a renamed Windows Address Book (WAB.exe) binary, observed as AdgNsy.exe, originating from an AppData local directory and spawned by WmiPrvSE.exe. This pattern is indicative of AdaptixC2 beaconing activity, leveraging WMI for execution to maintain persistence or conduct remote operations under the guise of a legitimate system utility.
Page 13 of 25