Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
506 detections
Filters
Last updated
All Time
Detection languages
174
86
73
69
35
Contributors
147
94
79
59
32
Categories
376
347
319
94
91
Platforms
491
8
7
3
2
Products / Services
10,665
9,758
6,692
4,418
3,749
506
MITRE Techniques
333
272
136
126
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Detects the WMI provider host (wmiprvse.exe) spawning common living-off-the-land binaries often associated with command execution or lateral movement.
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Detects the deletion of volume shadow copies using common Windows administrative tools such as vssadmin, wmic, and PowerShell. This activity is frequently observed during the pre-encryption stage of ransomware attacks to prevent system restoration.
Detects the WMI provider host process (WmiPrvSE.exe) spawning common command-line or system administration tools such as cmd.exe, powershell.exe, or rundll32.exe. This activity is correlated with a preceding network connection to the host on port 135 (DCOM/WMI), which is indicative of lateral movement using WMI.
Detects a potential WMI-based persistence mechanism by identifying the sequential execution of mofcomp.exe to compile a MOF file located in a temporary directory, followed by the execution of a VBScript payload using cscript.exe with the /e:VBScript.Encode flag. This pattern is indicative of an attacker attempting to establish persistence via WMI event subscriptions.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects the abuse of Windows Management Instrumentation (WMI) to execute processes via wmic.exe or WmiPrvSE.exe, often combined with obfuscated command-line arguments such as encoded PowerShell or CMD commands.
Detects the use of legitimate Windows administrative tools (vssadmin, wmic, wbadmin, bcdedit, sc, net) to delete volume shadow copies, clear backup catalogs, disable boot recovery options, or stop critical backup and system services. This behavior is highly characteristic of ransomware activity aiming to prevent data restoration and system recovery.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects the use of administrative utilities (psexec.exe, wmic.exe, powershell.exe, cmd.exe) initiating network connections over common remote management ports (135, 139, 445, 3389, 5985, 5986) to internal destinations. This behavior is indicative of lateral movement activity, particularly when initiated from a host that has recently engaged in credential harvesting or infostealer-related activity. The rule excludes common, expected sources to minimize noise.
Detects the deletion of Volume Shadow Copies and disabling of Windows boot recovery options using native administrative utilities such as vssadmin, wmic, powershell, wbadmin, and bcdedit. This behavior is frequently associated with pre-encryption activities in ransomware attacks to prevent system restoration.
Detects the creation or modification of WMI Event Subscriptions (Filters, Consumers, and Bindings) using administrative tools like wmic, powershell, or mofcomp. This behavior is commonly used by adversaries to establish persistence or facilitate execution via WMI event triggers.
Detects remote command execution patterns associated with the Impacket suite (e.g., wmiexec.py, atexec.py, smbexec.py). The detection identifies cmd.exe processes spawned by WmiPrvSE.exe or svchost.exe that contain specific command-line arguments indicative of Impacket's remote execution behavior, such as output redirection to hidden administrative shares or temporary files.
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
Detects execution of various reconnaissance commands commonly used by Remote Access Trojans (RATs) to profile a target host. This includes querying security product status (AV/Defender), enumerating domain controllers, network adapters, port scanning, and gathering system hardware and software inventory.
Detects instances of potential lateral movement using PsExec or WMI following an alert related to credential compromise, infostealers, or session hijacking, where the same user account is involved in both events.
Page 1 of 25