Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects reconnaissance behavior associated with the KuinaExtractor tool, identified by three or more distinct WMI hardware-related queries (CPU, disk, memory, etc.) executed within a 5-minute window by a non-administrative parent process.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Detects the use of WMIC to query system information, such as BIOS, computer system, or product details. Adversaries often use this technique during the discovery phase to gather information about a target host's hardware and environment.
Detects the use of WMIC to query system information, such as BIOS, computer system, or product details. Adversaries often use this technique during the discovery phase to gather information about a target host's hardware and environment.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects potential lateral movement via Windows Management Instrumentation (WMI) by monitoring for WMI processes spawning interactive shells (cmd, powershell) or executing remote process calls using the /node syntax. Includes exclusions for common administrative tools associated with Microsoft management platforms.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects the use of wmic.exe to execute commands or retrieve OS information on remote systems by monitoring for the '/node:' flag in command lines. The rule excludes local host references (localhost, 127.0.0.1) to focus on remote management activity that may indicate lateral movement or remote code execution.
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.
Correlates the ransomware utilizing WMI (Win32_Process Create) to remotely execute its copied binary on discovered lateral targets. This rule specifically looks for 'wmiprvse.exe' initiating a process where the initiating process is also 'wmiprvse.exe' and the folder path matches a common administrative share like 'Admin$' or 'C$'.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Page 17 of 25