Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
141 rules
Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)
Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.
Tom Ueltschi (@c_APT_ure), Huntrule TeamWindowswmi_eventMedium61Free2019-01-12Windows WMI Script Event Consumer Execution via scrcons.exe
Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.
Thomas Patzke, Huntrule TeamWindowsprocess_creationMedium227Free2018-03-07Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe
Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.
Thomas Patzke, Huntrule TeamWindowsimage_loadHigh83Free2018-03-07Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)
Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.
Thomas Patzke, Huntrule TeamWindowsfile_eventHigh439Free2018-03-07Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration
Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.
Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community, Huntrule TeamWindowswmiMedium234Free2017-08-22Windows WMI Persistence via Security Event 4662 on WMI subscription namespace
Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.
Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community, Huntrule TeamWindowssecurityMedium81Free2017-08-22