Sigma detection rules, expert-reviewed

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows DLL Sideloading: WmiApSrv Loads VMGuestLib.dll

Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell WMI Script Deletes Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

Flags mofcomp.exe runs spawned by script interpreters or using temp/AppData paths, with exclusions for WmiPrvSE .mof-related activity.

Windows wmic.exe Used to Start or Stop Services

Alerts on wmic.exe command lines invoking startservice or stopservice via service calls.

Windows WMIC Process Creation Recon for Unquoted Service Paths

Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.

Windows Hotfix Inventory Recon via wmic.exe qfe

Detects wmic.exe executions with "qfe" used to enumerate installed Windows hotfixes.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

PowerShell WMI Win32_Product MSI Installation via Invoke-CimMethod

Flags PowerShell using WMI Win32_Product via Invoke-CimMethod to invoke an MSI install.