Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
174
86
74
69
35
Contributors
147
94
79
60
32
Categories
377
347
319
94
91
Platforms
492
8
7
3
2
Products / Services
10,665
9,773
6,704
4,421
3,749
507
MITRE Techniques
333
272
136
127
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects a process performing cryptocurrency wallet/messenger folder discovery (Ledger Live, Atomic, Exodus, Guarda, KeepKey, BitBox02, Signal) combined with antivirus product enumeration (via rootSecurityCenter2, AntiVirusProduct, or WMI SELECT displayName queries) within the same host/process/time window, consistent with CountLoader host-profiling behavior.
Detects the creation or modification of WMI event subscriptions using the wmic.exe command-line utility. Adversaries utilize WMI event subscriptions for persistence by configuring event filters, consumers, and bindings that execute malicious code upon specific system events.
Detects the creation of WMI event filters for the Win32_SystemStartup class via wmic.exe. This technique is used by the TOKYOCORE ransomware to achieve fileless, reboot-persistent execution by triggering malicious code when specific system events occur.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects the execution of sequences of built-in administrative command-line tools often used by adversaries for system discovery and reconnaissance. The rule triggers on specific patterns of commands (e.g., WMI queries, system information gathering, or comprehensive user enumeration) that are frequently combined by attackers to understand the target environment.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Page 9 of 25