Sigma detection rules, expert-reviewed

Windows SharpMove (.NET) Execution via SharpMove.exe and Action Command-Line Flags

Alerts on SharpMove.exe process execution with command-line actions for DCOM, WMI VBS, and task scheduler.

Windows WMIC System Information Discovery via WMI Command-Line Queries

Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.

Windows Process Creation: Detect Event Log Query via wmic.exe, wevtutil.exe, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

Windows Process Creation: wmic.exe call terminate Attempt

Alerts on wmic.exe being executed with “call terminate”, indicating an attempt to terminate a process on Windows.

Windows Registry: New BgInfo UserFields value enabling custom WMI query execution

Alerts on new BgInfo UserFields registry entries that appear to configure a custom WMI query.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic

Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.

Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)

Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.

Windows WMIC Remote Query Execution via /node

Identifies remote WMIC queries on Windows by matching WMIC execution with /node: in the command line.

Windows WMIC.exe Service Reconnaissance via Remote Service Queries

Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.

Windows WMIC.exe Product Class Reconnaissance via Security Product Queries

Detects wmic.exe being used to enumerate firewall, antivirus, and antispyware product classes.

Windows WMIC Product Reconnaissance via Firewall/AV Enumeration

Alerts on wmic.exe executions with command lines consistent with Windows product enumeration for reconnaissance.

Windows wmic.exe Hardware Model Reconnaissance Using csproduct

Flags wmic.exe executions that include "csproduct" to query hardware model/vendor details.

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.