Sigma detection rules, expert-reviewed

Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)

This rule detects wmic launching a masqueraded svhost binary from the Windows Temp directory on a remote node with an IP argument, the QDoor proxy-deployment technique in the fake Zoom BlackSuit intrusion used to tunnel traffic through internal hosts. Adversaries push proxy backdoors via remote WMI process creation to relay command-and-control deeper into the network, so this chained pattern is a strong lateral-movement and proxy indicator.

Malicious Remote Payload Deployment via WMIC Node Process Call Create with bitsadmin Transfer (via process_creation)

This rule detects wmic invoking process call create against a remote node to run a bitsadmin transfer that pulls and launches a payload from an admin share, the lateral-distribution method used to push the LockBit binary in the Cobalt Strike SOCKS intrusion. Adversaries combine remote WMI process creation with bitsadmin staging to spread ransomware without dropping tooling first, so this chained command is a strong lateral-movement indicator.

Malicious WMIexec Style Command Output Redirection to Local Admin Share

This rule detects the wmiexec remote execution pattern where a command shell redirects its output to the local ADMIN dollar share over the loopback address as observed in the Hive intrusion during lateral movement and this matters because legitimate administration does not stage command output to a loopback SMB admin share and this behavior is characteristic of impacket style remote execution.

Suspicious Antivirus Enumeration via WMIC SecurityCenter2

This rule detects wmic.exe querying the SecurityCenter2 namespace for installed AntiVirusProduct entries, a defense discovery step used by Seedworm to profile endpoint protection before deploying further tooling.

Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)

This rule detects creation of the Abyss Locker persistence backdoor, an SSH client wrapped as a service under the Microsoft WMI application data directory together with its private key and service configuration. The actor installed this component as a service named WMI Helper Agent using a service wrapper to maintain covert reverse tunnel access. These paths are not associated with legitimate WMI functionality.

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

This rule detects WMIC being used to enumerate and delete Volume Shadow Copies, an inhibit-recovery step performed before encryption in the Confluence exploitation ransomware intrusion reported by Red Canary. Removing shadow copies prevents victims from restoring encrypted files, so this command is a strong precursor to imminent ransomware detonation.

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

This rule detects execution of the mssq.bat script used by Phantom Taurus to run SQL queries against databases via the privileged sa account, invoked through WMI. The batch file automates data collection and command execution against Microsoft SQL Server. Detecting this named script exposes hands-on-keyboard database targeting by the actor.

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Malicious Gelsemium OwlProxy wmipd DLL Load via image_load

This rule detects the load of wmipd.dll which is the OwlProxy backdoor registered as a service masquerading as a WMI Provider. The suspected Gelsemium activity against a Southeast Asian government installed OwlProxy for proxying and persistence, and the impostor module name is a strong indicator of the malicious service DLL.

Malicious Antivirus Removal via WMIC Product Uninstall

This rule detects abuse of wmic.exe to enumerate installed products through the product class and invoke their uninstall method non-interactively, a technique used by LemonDuck first-stage payloads to silently remove antivirus and endpoint protection. Stripping defensive software before the next stage runs weakens host protections and lets the attacker operate undetected.

Suspicious Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of volume shadow copies using vssadmin or wmic, an inhibit recovery step performed by The Gentlemen ransomware before encryption. Removing shadow copies prevents victims from restoring files and is a strong pre-encryption indicator of a destructive attack.

Malicious Mshta Spawned by WMI or WinRM Provider via process_creation

This rule detects mshta.exe launched by the WMI provider host or the WinRM host process which indicates remote or lateral proxy execution of an HTA payload. GOFFEE triggered mshta.exe from wmiprvse.exe and wsmprovhost.exe to run remote HTA content while blending with management traffic. This parent child relationship is abnormal and points to hands-on remote code execution.

Suspicious Remote Process Creation via WMIC by Mallox

This rule detects WMIC being used with process call create, a lateral and local execution technique Mallox operators use to launch payloads through WMI. This command form is rare in normal administration and is a common ransomware execution primitive.

Suspicious Shadow Copy Creation via WMIC (via process_creation)

This rule detects use of wmic to invoke shadowcopy call create which ToddyCat performs to snapshot the volume and then archive the Chrome shadow copy for offline browser credential and data theft.