Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects evidence of Turla STOCKSTAY malware performing environmental keying via WMI system discovery (collecting OSVersion, MachineName, and UserName) followed by the execution of components from the specific %LOCALAPPDATA%\Programs\SMN\ directory. This behavior suggests the malware is using system-specific attributes to decrypt configuration or verify the environment before proceeding.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components that use WMI via the ManagementObjectSearcher class to perform system reconnaissance. The rule monitors for unauthorized child process spawning of WmiPrvSE.exe by identified malicious executable files, indicating active system and process information gathering.
This rule detects the use of wmic.exe to execute commands or manage remote systems, specifically flagging indicators of lateral movement, credential usage, or command execution like 'node', 'user', 'password', and 'call create'.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects lateral movement or persistence where WMI directly spawns an RMM tool like ScreenConnect, AnyDesk, or other common remote management tools. This activity is often indicative of an attacker establishing remote access or maintaining persistence on a compromised system.
Identifies the fake VPN installer using WMI to query SecurityCenter2 to identify installed security products before unpacking the stealer. This rule specifically looks for 'wmiprvse.exe' executing with command-line arguments related to 'AntiVirusProduct' and correlates this with the execution of processes named 'GlobalProtect', 'AnyConnect', or 'VPN'.
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Detects WMI reconnaissance commands targeting the SecurityCenter2 namespace (e.g., AntiVirusProduct, FirewallProduct) or system information (e.g., Win32_OperatingSystem) executed via wmic.exe, powershell.exe, or pwsh.exe. This activity is consistent with post-exploitation reconnaissance techniques utilized by DcRAT malware as observed in Operation DragonReturn.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects the use of wmic.exe to spawn or interact with wscript.exe, which is a common pattern used by adversaries to execute scripts via WMI.
Detects the use of WMIC to query for the system's UUID. This activity is often performed by adversaries during the discovery phase to gather system information.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Detects the use of the WMIC.exe utility to execute processes on remote systems using the 'process call create' command. This technique is commonly used by adversaries for lateral movement. The rule excludes local execution scenarios.
This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects the WMI provider executing heavily encoded commands mapped to Kazuar's tasking structure for lateral movement. Specifically, it looks for 'wmiprvse.exe' initiating processes that execute PowerShell or cmd commands containing encoding indicators like 'enc' or 'FromBase64String'.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
Page 18 of 25