Sigma detection rules, expert-reviewed

Windows WMIC.exe Product Class Reconnaissance via Security Product Queries

Detects wmic.exe being used to enumerate firewall, antivirus, and antispyware product classes.

Windows WMIC Product Reconnaissance via Firewall/AV Enumeration

Alerts on wmic.exe executions with command lines consistent with Windows product enumeration for reconnaissance.

Windows wmic.exe Hardware Model Reconnaissance Using csproduct

Flags wmic.exe executions that include "csproduct" to query hardware model/vendor details.

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows DLL Sideloading: WmiApSrv Loads VMGuestLib.dll

Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell WMI Script Deletes Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Process Creation: Suspicious Service Stop/Pause/Delete/Disable via net, sc, PowerShell

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

Flags mofcomp.exe runs spawned by script interpreters or using temp/AppData paths, with exclusions for WmiPrvSE .mof-related activity.

Windows wmic.exe Used to Start or Stop Services

Alerts on wmic.exe command lines invoking startservice or stopservice via service calls.

Windows WMIC Process Creation Recon for Unquoted Service Paths

Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.

Windows Hotfix Inventory Recon via wmic.exe qfe

Detects wmic.exe executions with "qfe" used to enumerate installed Windows hotfixes.