Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
This rule detects the use of 'wmic.exe', 'powershell.exe', or 'pwsh.exe' to interact with WMI event consumers (ActiveScriptEventConsumer or CommandLineEventConsumer) and filter bindings. Adversaries use these WMI components to establish persistence by executing malicious code when specific system events occur, such as a process start or a scheduled time trigger.
This rule detects the use of 'wmic.exe', 'powershell.exe', or 'pwsh.exe' to interact with WMI event consumers (ActiveScriptEventConsumer or CommandLineEventConsumer) and filter bindings. Adversaries use these WMI components to establish persistence by executing malicious code when specific system events occur, such as a process start or a scheduled time trigger.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Detects BQT.exe or start.exe performing activities indicative of sandbox or virtual machine environment evasion. This includes querying registry keys related to virtualization artifacts, spawning system information tools like wmic.exe, systeminfo.exe, or reg.exe, and enumerating processes associated with virtualization software like vmtoolsd.exe, vboxservice.exe, or vboxtray.exe.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects the creation of a local administrator account or modification of the Administrators group through ConfigurationRemotingServer.exe. This activity is associated with the DSCourier persistence technique, which leverages Windows PowerShell Desired State Configuration (DSC) to maintain unauthorized administrative access.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
This rule detects network activity associated with lateral movement using Windows Management Instrumentation (WMI). It specifically looks for a DCE/RPC Bind request that targets the IWbemServices interface UUID, a common method for initializing remote WMI connections to execute commands on remote systems.
This rule detects a specific environmental keying pattern indicative of malware or reconnaissance tools attempting to identify hostnames and domain membership. It monitors for a sequence of activities occurring within a 30-second window: querying the registry for computer name configuration, executing a WMI query for system information, and querying environment variables. The detection further filters for processes that exhibit this behavior without subsequent network activity or child process creation, which is characteristic of 'silent' environmental keying techniques.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.
Detects instances where the WMI Provider Host process (WmiPrvSE.exe) spawns common interactive shells, scripting interpreters, or other binaries typically associated with remote command execution. This pattern is a strong indicator of WMI being abused for lateral movement or remote code execution within a Windows environment.
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
Detects anomalous use of WMI queries or the wmic.exe utility to gather system or antivirus configuration information from suspicious paths (e.g., Temp, AppData) or when executed by unexpected processes. This pattern often indicates early-stage discovery by malicious software.
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Page 14 of 25