Sigma detection rules, expert-reviewed

Malicious Remote Process Creation via wmic node call create

This rule detects wmic invoking process call create against a remote node. The CloudComputating group used this WMI technique to execute commands on remote hosts for lateral movement across the network, which is uncommon in routine administration.

Malicious Impacket WMIexec Execution via SMB Admin Share (via security)

This rule detects remotely execute WMIexec via SMB admin share in order to escalate privileges.

Malicious Impacket wmiexec Output Redirection via ADMIN Share

This rule detects the characteristic Impacket wmiexec command line that redirects command output to a temporary file on the local admin share over the loopback address as described in the WithSecure WMI lab. This redirection pattern is highly specific to semi interactive Impacket WMI execution and is a strong indicator of remote lateral movement by an attacker toolkit.

Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type

Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell

Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.

Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands

Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.