Sigma detection rules, expert-reviewed

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

PowerShell WMI Win32_Product MSI Installation via Invoke-CimMethod

Flags PowerShell using WMI Win32_Product via Invoke-CimMethod to invoke an MSI install.

Windows process access indicating potential shellcode injection to lsass.exe

Alerts on high-privilege process access from wmiprvse.exe to lsass.exe consistent with potential shellcode injection behavior.

Windows: Application Uninstall via WMIC.exe (WMIC call uninstall)

Flags WMIC.exe commands that include "call" and "uninstall," indicating potential application removal on Windows.

Windows WMIC Process Flag Execution Indicating Process Reconnaissance

Alerts on wm ic.exe executions using the 'process' flag, consistent with attempting to enumerate running processes.

RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs

Alerts on RPC Firewall RPC events indicating remote DCOM/WMI interface activity that can support lateral movement.

PowerShell Scheduled Task Creation via ScriptBlock Logging

Identifies PowerShell script blocks that create and register scheduled tasks using TaskScheduler cmdlets or CIM WMI method calls.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

Detects WMI event consumer encoded payloads containing suspicious execution-related strings on Windows.

Windows WMI Event Consumer (scrcons.exe) Creates Named Pipe

Flags scrcons.exe creating a Windows named pipe, using named pipe creation event telemetry.

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.