Sigma detection rules, expert-reviewed

Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.

Windows: WmiPrvSE.exe Spawning a Child Process

Identifies child processes created by WmiPrvSE.exe on Windows, highlighting potential WMI-based execution attempts.

Windows Image Load: WMI DLLs Loaded by Uncommon Process

Alert on loading of common WMI DLLs by processes outside typical system/.NET paths.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Process Creation Attempt Using wmic.exe process call create

Alerts on Windows process creation attempts invoking wmic.exe with “process call create”, a common pattern for WMI-based execution.

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

Windows WMI Script Event Consumer Execution via scrcons.exe

Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.

Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe

Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.

Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)

Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.