Sigma detection rules, expert-reviewed

Suspicious WMIC Remote Process Creation Installing MSI via Command Line

This rule detects wmic invoking process call create to launch msiexec, a WMI-based execution technique used after Citrix Bleed exploitation to deploy the LockBit loader. Combined use of process call create with msiexec is rarely legitimate on endpoints. Detecting it exposes remote or local code execution via WMI.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

This rule detects the use of wmic to enumerate services by their executable path and delete or stop those belonging to Sophos endpoint protection, a technique used by Terminator and its variants to disable security tooling before deploying ransomware or a cryptominer. The command selects services whose PathName matches a security vendor string and invokes delete or stopservice.

Suspicious Antivirus Product Enumeration via WMI Query via process_creation

This rule detects command lines that query the Windows Security Center AntiVirusProduct class which attackers use to enumerate installed security software before deploying payloads. SideWinder profiled endpoint defenses through WMI antivirus enumeration to tailor its evasion. Discovery of security tooling frequently precedes defense evasion and payload delivery.

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

This rule detects PowerShell use of the Invoke-WMIExec or Invoke-SMBExec pass-the-hash tooling observed alongside the ThrottleStop AV-killer intrusion. These functions authenticate to remote hosts with an NTLM hash and run commands such as local account creation without a plaintext password. Their presence indicates hands-on lateral movement using stolen credential material.

Malicious Lateral Movement via Impacket WMIExec Command Pattern

This rule detects the Impacket wmiexec command pattern where cmd.exe runs with /Q /c and redirects output to a loopback ADMIN$ share, observed by Huntress during a targeted intrusion at a marketing research firm. Attackers use this pattern for semi-interactive remote command execution over WMI while capturing output through SMB. The loopback ADMIN$ output redirection is a distinctive signature of Impacket-style lateral movement.

Malicious Remote Process Creation via WMIC Node

This rule detects wmic invoking process call create against a remote node which the ALPHV actor used to launch payloads on other hosts during lateral movement and this matters because remote process creation through wmic is a well established lateral movement primitive that is uncommon in day to day administration and warrants scrutiny.

Suspicious Child Process Spawned by WmiPrvSe

This rule detects the WMI provider host WmiPrvSe.exe spawning command interpreters or scripting engines. This process tree is characteristic of remote WMI execution abuse for code execution and lateral movement. Shell processes parented to WmiPrvSe should be reviewed for unauthorized activity.

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

Malicious Impacket WMIExec ADMIN Share Output Redirection

This rule detects the Impacket wmiexec pattern where a command is executed through WMI and its output is redirected to the local ADMIN$ share on 127.0.0.1. The BlackJack group used WMIExec for remote command execution during lateral movement, and this loopback ADMIN$ redirection is characteristic of the tool.

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

This rule detects abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.

Suspicious Remote Execution via WMIC Node Process Call Create

This rule detects wmic.exe with the node parameter invoking process call create which the ColunmTK APT41 cluster uses to run install.bat on remote hosts for lateral movement. The technique executes commands against a specified target without dropping a service binary. It is important because remote WMIC execution is a stealthy hands-on-keyboard propagation method.

VSS Backup Deletion via WMI - Powershell (via powershell)

This rule detects delete existing VSS backup via WMI.

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

This rule detects cmd.exe spawned by the WMI provider host with a command line referencing the ADMIN administrative share, a remote execution pattern Volt Typhoon uses to run commands and stage output over WMI. Combining a WMI parent with administrative share access reflects remote lateral movement rather than routine local scripting, making it a strong signal of interactive intrusion activity.

VSS Backup Deletion - WMI (via process_creation)

This rule detects delete existing VSS backup.