Rule Library
Sigma Rules
3 rules found
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
WMI Event Subscription
Detects creation of WMI event subscription persistence method
WindowsWMI Event
Tom UeltschiSat Jan 12windows
Detectionhightest
Suspicious Encoded Scripts in a WMI Consumer
Detects suspicious encoded payloads in WMI Event Consumers
WindowsWMI Event
Florian Roth (Nextron Systems)Wed Sep 01windows
Detectionhightest
Suspicious Scripting in a WMI Consumer
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
WindowsWMI Event
Florian Roth (Nextron Systems)+1Mon Apr 15windows