Sigma detection rules, expert-reviewed

Malicious Event Log Clear Attempt - Wmi (via process_creation)

This rule detects clear the event logs.

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

This rule detects wmic.exe being used to enumerate host security and system information, such as querying installed antivirus products, operating-system details or running processes for situational awareness. WMI-based discovery is called out in the Red Canary Threat Detection Report as an early hands-on-keyboard step that informs an adversary's next moves. Detecting these reconnaissance queries surfaces post-compromise triage before escalation.

Malicious Impacket WMIexec Process Execution (via process_creation)

This rule detects execute WMIexec in order to escalate privileges.

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

This rule detects the WMI Provider Host (WmiPrvSE.exe) spawning a command shell or script interpreter, an execution pattern that indicates local or remote code execution through Windows Management Instrumentation. WMI is a top execution and lateral-movement technique in the Red Canary Threat Detection Report because it runs under a trusted service and leaves little on disk. Detecting interpreter children of WmiPrvSE surfaces WMI-based hands-on activity.

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

This rule detects wMIimplant.

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

This rule detects WMIC queries against keyboard, pointing device and monitor WMI classes used by the SHUYAL stealer to fingerprint the host and detect analysis environments before stealing credentials. Adversaries enumerate attached hardware to build a victim profile and to evade sandboxes that lack real peripherals.

DragonForce Ransomware Volume Shadow Copy Deletion via WMIC ShadowCopy Where Delete (via process_creation)

This rule detects abuse of WMIC to enumerate and delete a specific volume shadow copy by ID, the inhibit-recovery behavior DragonForce ransomware performs through cmd.exe before file encryption. Adversaries delete shadow copies so victims cannot restore encrypted files, making early detection critical for interrupting the intrusion before data becomes unrecoverable.

In-Memory Ramnit Process Injection Target Spawned by WmiPrvSE in drIBAN Fraud Operation (via process_creation)

This rule detects the WMI provider host WmiPrvSE.exe spawning ImagingDevices.exe, Wab.exe, or Wabmig.exe, the seldom-executed signed Windows binaries that Ramnit uses as injection hosts after sLoad delivery in the drIBAN banking-fraud operation. Adversaries launch these low-noise processes from WMI to host injected banking-trojan code under a trusted image, making early detection critical for surfacing the intrusion before man-in-the-browser fraud.

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

This rule detects a Node.js or npm process spawning wmic to enumerate logical disks which the North Korean Contagious Interview malware runs for host reconnaissance after a fake coding challenge executes. Developer-tooling parents launching WMI discovery is anomalous and marks the malicious interview package. It reveals early victim profiling before credential theft.

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

This rule detects wmic being spawned by an anomalous parent such as an Office application, browser or scripting host. Legitimate WMIC use rarely originates from these processes, so this parent-child relationship points to WMI being abused for execution or discovery following initial access.

Suspicious WMIC Remote Process Creation Installing MSI via Command Line

This rule detects wmic invoking process call create to launch msiexec, a WMI-based execution technique used after Citrix Bleed exploitation to deploy the LockBit loader. Combined use of process call create with msiexec is rarely legitimate on endpoints. Detecting it exposes remote or local code execution via WMI.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

This rule detects the use of wmic to enumerate services by their executable path and delete or stop those belonging to Sophos endpoint protection, a technique used by Terminator and its variants to disable security tooling before deploying ransomware or a cryptominer. The command selects services whose PathName matches a security vendor string and invokes delete or stopservice.

Suspicious Antivirus Product Enumeration via WMI Query via process_creation

This rule detects command lines that query the Windows Security Center AntiVirusProduct class which attackers use to enumerate installed security software before deploying payloads. SideWinder profiled endpoint defenses through WMI antivirus enumeration to tailor its evasion. Discovery of security tooling frequently precedes defense evasion and payload delivery.