Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Wmiprvse Wbemcomn DLL Hijack - File

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

ATT&CK coverage

Execution

T1047Windows Management Instrumentation 86 detections cover this technique

Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares 70 detections cover this technique

Detection requirements

Log source product: windows
Log source category: file_event

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.