Sigma detection rules, expert-reviewed

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

This rule detects PowerShell use of the Invoke-WMIExec or Invoke-SMBExec pass-the-hash tooling observed alongside the ThrottleStop AV-killer intrusion. These functions authenticate to remote hosts with an NTLM hash and run commands such as local account creation without a plaintext password. Their presence indicates hands-on lateral movement using stolen credential material.

Malicious Lateral Movement via Impacket WMIExec Command Pattern

This rule detects the Impacket wmiexec command pattern where cmd.exe runs with /Q /c and redirects output to a loopback ADMIN$ share, observed by Huntress during a targeted intrusion at a marketing research firm. Attackers use this pattern for semi-interactive remote command execution over WMI while capturing output through SMB. The loopback ADMIN$ output redirection is a distinctive signature of Impacket-style lateral movement.

Malicious Remote Process Creation via WMIC Node

This rule detects wmic invoking process call create against a remote node which the ALPHV actor used to launch payloads on other hosts during lateral movement and this matters because remote process creation through wmic is a well established lateral movement primitive that is uncommon in day to day administration and warrants scrutiny.

Suspicious Child Process Spawned by WmiPrvSe

This rule detects the WMI provider host WmiPrvSe.exe spawning command interpreters or scripting engines. This process tree is characteristic of remote WMI execution abuse for code execution and lateral movement. Shell processes parented to WmiPrvSe should be reviewed for unauthorized activity.

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

Malicious Impacket WMIExec ADMIN Share Output Redirection

This rule detects the Impacket wmiexec pattern where a command is executed through WMI and its output is redirected to the local ADMIN$ share on 127.0.0.1. The BlackJack group used WMIExec for remote command execution during lateral movement, and this loopback ADMIN$ redirection is characteristic of the tool.

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

This rule detects abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.

Suspicious Remote Execution via WMIC Node Process Call Create

This rule detects wmic.exe with the node parameter invoking process call create which the ColunmTK APT41 cluster uses to run install.bat on remote hosts for lateral movement. The technique executes commands against a specified target without dropping a service binary. It is important because remote WMIC execution is a stealthy hands-on-keyboard propagation method.

VSS Backup Deletion via WMI - Powershell (via powershell)

This rule detects delete existing VSS backup via WMI.

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

This rule detects cmd.exe spawned by the WMI provider host with a command line referencing the ADMIN administrative share, a remote execution pattern Volt Typhoon uses to run commands and stage output over WMI. Combining a WMI parent with administrative share access reflects remote lateral movement rather than routine local scripting, making it a strong signal of interactive intrusion activity.

VSS Backup Deletion - WMI (via process_creation)

This rule detects delete existing VSS backup.

Suspicious PowMix Scheduled Task Launching LNK via Explorer

This rule detects creation of a scheduled task that runs explorer.exe against a shortcut file, matching the PowMix botnet persistence that fires a daily task at 11:00 to relaunch its malicious LNK through Explorer. Abusing explorer.exe to open an attacker LNK on a schedule masks the loader chain as ordinary shell activity. This persistence pattern indicates a PowMix foothold on the host.

Malicious Remote XSL Script Execution via WMIC Squiblytwo Technique

This rule detects WMIC invoking a remote XSL stylesheet via the format switch which is the squiblytwo technique used by the Lazarus chain to execute attacker script content as analysed by NCC Group. Loading a remote XSL through a signed system binary evades application control and downloads code from adversary infrastructure.

Suspicious tapiperf.dll Load by WMI Provider Host via Image Load

This rule detects wmiprvse.exe loading tapiperf.dll, which the Lunar toolset abuses through DLL replacement to gain execution inside a trusted Windows process. Legitimately tapiperf.dll is a TAPI performance counter library and is not loaded by the WMI provider host. This anomalous load points to DLL hijacking used for stealthy persistence and code execution.

Malicious Volgmer Payload Storage in WMI Security Registry Key

This rule detects creation of specific named values under the WMI Security registry key used by the Hidden Cobra Volgmer backdoor to hide its encoded configuration and payload. Writing data to this rarely used registry location under these hardcoded GUID value names is a high-confidence indicator of a Volgmer infection.