Every published rule

Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic

Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.

Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)

Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.

Windows WMIC Remote Query Execution via /node

Identifies remote WMIC queries on Windows by matching WMIC execution with /node: in the command line.

Windows WMIC.exe Service Reconnaissance via Remote Service Queries

Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.

Windows WMIC.exe Product Class Reconnaissance via Security Product Queries

Detects wmic.exe being used to enumerate firewall, antivirus, and antispyware product classes.

Windows WMIC Product Reconnaissance via Firewall/AV Enumeration

Alerts on wmic.exe executions with command lines consistent with Windows product enumeration for reconnaissance.

Windows wmic.exe Hardware Model Reconnaissance Using csproduct

Flags wmic.exe executions that include "csproduct" to query hardware model/vendor details.

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows DLL Sideloading: WmiApSrv Loads VMGuestLib.dll

Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell WMI Script Deletes Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Process Creation: Suspicious Service Stop/Pause/Delete/Disable via net, sc, PowerShell

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

Flags mofcomp.exe runs spawned by script interpreters or using temp/AppData paths, with exclusions for WmiPrvSE .mof-related activity.

Windows wmic.exe Used to Start or Stop Services

Alerts on wmic.exe command lines invoking startservice or stopservice via service calls.

Windows WMIC Process Creation Recon for Unquoted Service Paths

Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.

Windows Hotfix Inventory Recon via wmic.exe qfe

Detects wmic.exe executions with "qfe" used to enumerate installed Windows hotfixes.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.