Sigma detection rules, expert-reviewed

PowerShell WMI Event Subscription Persistence via New-CimInstance

Finds PowerShell creating WMI __EventFilter and CommandLineEventConsumer objects for event-triggered persistence.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Windows WMI Shadow Copy Deletion via PowerShell

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

Windows WMIC Uninstall/Terminate Actions Targeting Security Products

Flags WMIC commands on Windows that attempt to uninstall or terminate security products or sensors using known vendor/product strings.

Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation

Flags Windows command lines where PowerShell/WMI is used to spawn rundll32 from c:\windows.

Windows WMIC loading JavaScript/VBScript engine libraries

Alerts on wmic.exe loading jscript.dll or vbscript.dll, a common sign of script execution via Windows Management Instrumentation.

Windows WMIC process creation with suspicious command execution

Alerts on WMIC spawning new processes with command-line indicators of common execution/payload binaries on Windows.

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem

Alerts when System creates wbemcomn.dll in C:\Windows\System32\wbem\, consistent with WMI DLL hijack file staging.

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.

Windows Security: Suspicious Remote Logon Using Explicit Credentials via Command-Line Tools

Flags EventID 4648 remote logons initiated by cmd/PowerShell/winrs/wmic/net/reg-style processes using explicit credentials.

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Alerts when scrcons.exe loads vbscript/wbem/WMI script DLLs, suggesting WMI ActiveScriptEventConsumer activity.

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

Flags remote network logons involving scrcons.exe that may indicate WMI ActiveScriptEventConsumers activity.