Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
Detects WMI queries targeting QoS policy setting data for enumeration or manipulation. This could indicate an adversary attempting to discover or modify Quality of Service policies on a system.
Detects the initialization of the NetQosCim WMI provider, an indicator of QoS policy tampering.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects uninstallation or termination of security products using the WMIC utility
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects the creation of WMI event subscriptions, which can be used by adversaries for persistence. The rule specifically looks for command-line arguments related to WMI namespace manipulation or PowerShell cmdlets for WMI event creation.
Detects enumeration of AV and security products via WMI
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Detects the creation of WMI event subscriptions, which can be used by adversaries for persistence. The rule specifically looks for command-line arguments related to WMI namespace manipulation or PowerShell cmdlets for WMI event creation.
Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.
This rule detects attempts to enumerate installed software on a Windows machine via Remote WMI (Windows Management Instrumentation) over SMB (Server Message Block) on port 445. Specifically, it looks for the string "Win32_Product" within TCP traffic destined for port 445, indicating a WMI query for installed products. A threshold of 5 occurrences within 30 seconds from the same source is set to reduce false positives.
WMI Drive Discovery By MediaType
Cortex XDR
Detects a specific WMI query used by GammaWorm to find network drives and low-cost USB drives for malware propagation by filtering for mediatype=null. This query targets 'win32_logicaldisk' and specifically looks for drives where 'mediatype=null', which can indicate network or removable drives.
This rule detects the remote creation of a WMI event subscription, specifically looking for '__EventFilter' and 'CommandLineEventConsumer' within TCP traffic on port 445. This activity is often associated with persistence mechanisms used by attackers.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives). This technique is known to be used by the GammaSteel threat group to monitor and potentially steal data from physical media.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
Page 19 of 25