Sigma detection rules, expert-reviewed

Suspicious Process Creation via wmic Call Create

This rule detects the wmic.exe process call create syntax used to spawn new processes, optionally against a remote host via /node. Adversaries abuse WMI to execute payloads locally and laterally while evading process-tree scrutiny. Interactive wmic process creation is uncommon in normal operations.

Suspicious Process Creation via WMIC Process Call Create

This rule detects wmic.exe launching a new process through the process call create method which APT41 leverages for stealthy local and remote execution. The technique spawns children under WmiPrvSE outside normal parent chains to evade detection. It matters because it is a frequent whitelisting bypass used during hands-on-keyboard activity.

Malicious Remote Process Creation via WMI Win32_Process

This rule detects use of WMI to create a process through the Win32_Process class from wmic or a script host, an execution technique observed in a MuddyWater APT campaign targeting the Middle East to run payloads while evading direct process lineage. It captures lateral or local execution driven through the WMI provider. Detecting this is important because Win32_Process Create invocations are a frequent attacker method to launch code outside normal parent-child relationships.

Suspicious WMI Provider Host Spawning Explorer or wlrmdr via Process Creation

This rule detects WmiPrvSE.exe spawning explorer.exe or wlrmdr.exe, an execution chain MirrorFace uses in Operation AkaiRyu to launch its tooling through WMI while abusing rarely spawned Windows binaries as hosts. The WMI provider host does not normally start these processes. This indicates WMI-based execution during an espionage intrusion reviving the ANEL backdoor.

Suspicious Virtual Machine Detection via WMI Win32_Process Query (via process_creation)

This rule detects sandbox and virtual machine evasion where a process enumerates running processes through the Win32_Process WMI class while looking for virtualization service binaries such as VboxService.exe or Vmtoolsd.exe. The D3F@ck loader performs this check to abort execution inside analysis environments. Such targeted VM discovery is a strong indicator of evasive malware.

Suspicious Remote Process Creation and Admin Share Copy via WMIC and Xcopy

This rule detects wmic process call create and xcopy operations targeting an administrative C dollar share, the lateral movement pattern used by WorkersDevBackdoor to stage and launch payloads on remote hosts. Copying to admin shares and invoking remote process creation lets attackers spread without dropping new remote access tooling.

Suspicious Antivirus Product Discovery via WMIC SecurityCenter2 Query

This rule detects use of wmic to query the SecurityCenter2 AntiVirusProduct namespace to enumerate installed security tooling, a reconnaissance step observed in DanaBot to IcedID intrusions. Attackers profile endpoint defenses before dropping later stages so they can select an evasion path.

Suspicious Anti-VM WMI Thermal Zone Temperature Query via Command Line

This rule detects a WMI query against MSAcpi_ThermalZoneTemperature, an anti-VM sandbox-evasion check that fails inside most virtual machines. StealC delivered through deceptive Google Sheets uses this probe before unpacking. Detecting the query reveals evasion logic running prior to payload execution.

Suspicious PowerShell WMI Video Controller Sandbox Evasion Check via OXLoader

This rule detects PowerShell querying the WMI Win32 VideoController class to inspect display refresh rate as a sandbox and virtualization check used by the OXLoader loader in Elastic research. Malware probes video controller properties to detect analysis environments before deploying the CASTLESTEALER payload, so this query in a script block signals evasion logic.

Suspicious WMI Query Against Windows Defender Namespace via wmic (via process_creation)

This rule detects wmic querying the Windows Defender WMI namespace, used by Sandworm to inspect and manipulate antivirus exclusions during the KMS campaign. Direct wmic access to the Defender namespace is uncommon in normal operations. It often precedes tampering with protection settings.

Suspicious WMIC System Reconnaissance via CSProduct UUID Query (via process_creation)

This rule detects WMIC querying the csproduct UUID for host fingerprinting. Maranhao Stealer issues this and related WMIC queries to build a unique victim identifier before exfiltration.

Lateral Movement via WMIC Remote Process Creation

This rule detects wmic.exe invoking process call create against a remote node, the technique used in Operation Soft Cell to execute batch payloads across telecom networks. Remote WMI process creation is a common lateral movement and execution vector for hands-on-keyboard operators.

Malicious PowMix AMSI Bypass via amsiInitFailed

This rule detects PowerShell script content that forces the amsiInitFailed condition to disable the Antimalware Scan Interface, matching the PowMix botnet loader targeting Czech users. Setting amsiInitFailed causes AMSI to skip scanning subsequent in-memory payloads, letting the fileless PowMix stager execute undetected. Presence of this bypass in script telemetry is a high-confidence evasion indicator.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.