Sigma detection rules, expert-reviewed

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

This rule detects a PowerShell one liner that downloads Invoke-WMIExec via a web client and executes it against a remote target using a pass the hash argument as observed in the MeshAgent and SuperShell intrusion. This chains in memory script download with WMI based lateral movement.

XSL Script Processing via WMIC or MSXSL (via process_creation)

This rule detects XSL script processing through wmic.exe /format with a remote or local .xsl stylesheet or through msxsl.exe, both of which execute embedded script and proxy code past application allowlisting. XSL script processing is a signed-binary-proxy-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary abuse used to run attacker-controlled script.

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

This rule detects wmic.exe invoking process call create, frequently against a remote node, which spawns a process through WMI for lateral movement or remote execution. WMIC-based remote execution is a technique tracked in the Red Canary Threat Detection Report for its use in hands-on-keyboard intrusions. Detecting this invocation surfaces attacker movement that blends into legitimate management traffic.

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

This rule detects command lines that enumerate installed antivirus or EDR products through the SecurityCenter2 WMI namespace or Get-MpComputerStatus, a security-software-discovery step taken to plan defense evasion. Security software discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces an attacker profiling defenses before acting.

Malicious Event Log Clear Attempt - Wmi (via process_creation)

This rule detects clear the event logs.

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

This rule detects wmic.exe being used to enumerate host security and system information, such as querying installed antivirus products, operating-system details or running processes for situational awareness. WMI-based discovery is called out in the Red Canary Threat Detection Report as an early hands-on-keyboard step that informs an adversary's next moves. Detecting these reconnaissance queries surfaces post-compromise triage before escalation.

Malicious Impacket WMIexec Process Execution (via process_creation)

This rule detects execute WMIexec in order to escalate privileges.

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

This rule detects the WMI Provider Host (WmiPrvSE.exe) spawning a command shell or script interpreter, an execution pattern that indicates local or remote code execution through Windows Management Instrumentation. WMI is a top execution and lateral-movement technique in the Red Canary Threat Detection Report because it runs under a trusted service and leaves little on disk. Detecting interpreter children of WmiPrvSE surfaces WMI-based hands-on activity.

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

This rule detects wMIimplant.

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

This rule detects WMIC queries against keyboard, pointing device and monitor WMI classes used by the SHUYAL stealer to fingerprint the host and detect analysis environments before stealing credentials. Adversaries enumerate attached hardware to build a victim profile and to evade sandboxes that lack real peripherals.

DragonForce Ransomware Volume Shadow Copy Deletion via WMIC ShadowCopy Where Delete (via process_creation)

This rule detects abuse of WMIC to enumerate and delete a specific volume shadow copy by ID, the inhibit-recovery behavior DragonForce ransomware performs through cmd.exe before file encryption. Adversaries delete shadow copies so victims cannot restore encrypted files, making early detection critical for interrupting the intrusion before data becomes unrecoverable.

In-Memory Ramnit Process Injection Target Spawned by WmiPrvSE in drIBAN Fraud Operation (via process_creation)

This rule detects the WMI provider host WmiPrvSE.exe spawning ImagingDevices.exe, Wab.exe, or Wabmig.exe, the seldom-executed signed Windows binaries that Ramnit uses as injection hosts after sLoad delivery in the drIBAN banking-fraud operation. Adversaries launch these low-noise processes from WMI to host injected banking-trojan code under a trusted image, making early detection critical for surfacing the intrusion before man-in-the-browser fraud.

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

This rule detects a Node.js or npm process spawning wmic to enumerate logical disks which the North Korean Contagious Interview malware runs for host reconnaissance after a fake coding challenge executes. Developer-tooling parents launching WMI discovery is anomalous and marks the malicious interview package. It reveals early victim profiling before credential theft.

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

This rule detects wmic being spawned by an anomalous parent such as an Office application, browser or scripting host. Legitimate WMIC use rarely originates from these processes, so this parent-child relationship points to WMI being abused for execution or discovery following initial access.