Sigma detection rules, expert-reviewed

Suspicious WMIC System Reconnaissance via CSProduct UUID Query (via process_creation)

This rule detects WMIC querying the csproduct UUID for host fingerprinting. Maranhao Stealer issues this and related WMIC queries to build a unique victim identifier before exfiltration.

Lateral Movement via WMIC Remote Process Creation

This rule detects wmic.exe invoking process call create against a remote node, the technique used in Operation Soft Cell to execute batch payloads across telecom networks. Remote WMI process creation is a common lateral movement and execution vector for hands-on-keyboard operators.

Malicious PowMix AMSI Bypass via amsiInitFailed

This rule detects PowerShell script content that forces the amsiInitFailed condition to disable the Antimalware Scan Interface, matching the PowMix botnet loader targeting Czech users. Setting amsiInitFailed causes AMSI to skip scanning subsequent in-memory payloads, letting the fileless PowMix stager execute undetected. Presence of this bypass in script telemetry is a high-confidence evasion indicator.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Suspicious Security Product Uninstall via wmic product call uninstall

This rule detects wmic being used to enumerate a product and invoke call uninstall, the technique Talos IR observed removing the Duo multi-factor agent to weaken defenses before ransomware deployment. Programmatic uninstallation of security or MFA software via WMI is a defense-evasion step that clears obstacles to lateral movement and encryption.

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

This rule detects creation of a Windows service named WmiPrvSV via sc.exe, a name that mimics the legitimate WMI Provider Host (WmiPrvSE) to blend in. The LAGTOY implant used by the ToyMaker initial access broker installs itself under this masqueraded service name for persistence, so this is a strong indicator of that access broker preparing hands-on-keyboard follow-up for double extortion gangs.

Malicious Impacket Wmiexec Remote Command Execution Pattern

This rule detects the command redirection pattern produced by Impacket wmiexec where cmd.exe is spawned by WmiPrvSE.exe to run a command and write output to a local admin share path. This semi interactive execution over WMI is a hallmark of lateral movement using stolen credentials as seen in the UAT-5918 activity.

Malicious Shadow Copy Deletion Via WMI

This rule detects PowerShell querying Win32_Shadowcopy and piping the result to Remove-WmiObject to delete volume shadow copies. Akira ransomware used Get-WmiObject Win32_Shadowcopy piped to Remove-WmiObject to destroy shadow copies before encryption. Deleting shadow copies is an inhibit-recovery action that prevents victims from restoring files without paying the ransom.

Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic, an anti-recovery step performed by Phobos ransomware deployed by the 8Base group. Removing shadow copies prevents victims from restoring encrypted files without paying. This inhibit-recovery behavior almost always precedes or accompanies ransomware encryption.

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

This rule detects the IIS process inetinfo.exe loading wmicodegen.dll, a DLL sideloading technique UAT-8099 uses to run Cobalt Strike on compromised web servers. The inetinfo.exe process has no legitimate reason to load this library. This load indicates in-memory beacon deployment via search-order hijacking.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

This rule detects writes to the HKLM SYSTEM CurrentControlSet Control WMI Security value with the GUID used by the Kimsuky PebbleDash backdoor to store its encrypted command and control address. This registry location is not normally written by user applications.