Sigma detection rules, expert-reviewed

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.

Windows SharpMove (.NET) Execution via SharpMove.exe and Action Command-Line Flags

Alerts on SharpMove.exe process execution with command-line actions for DCOM, WMI VBS, and task scheduler.

Windows WMIC System Information Discovery via WMI Command-Line Queries

Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.

Windows Process Creation: Detect Event Log Query via wmic.exe, wevtutil.exe, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

Windows Process Creation: wmic.exe call terminate Attempt

Alerts on wmic.exe being executed with “call terminate”, indicating an attempt to terminate a process on Windows.

Windows Registry: New BgInfo UserFields value enabling custom WMI query execution

Alerts on new BgInfo UserFields registry entries that appear to configure a custom WMI query.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic

Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.

Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)

Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.

Windows WMIC Remote Query Execution via /node

Identifies remote WMIC queries on Windows by matching WMIC execution with /node: in the command line.

Windows WMIC.exe Service Reconnaissance via Remote Service Queries

Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.