Detection rules › By catalog entry

Microsoft-Windows-WMI-Activity

Catalog entry	Rules
Event ID 5858	1
Event ID 5859	1
Event ID 5860	1
Event ID 5861	2

Event ID 5858

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog severity medium T1685,T1685.005

Event ID 5859

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

WMI Persistence severity medium T1546,T1546.003

Event ID 5860

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

WMI Temporary Event Subscription severity medium T1047

Event ID 5861

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

WMI Persistence severity medium T1546,T1546.003

Splunk (1)

WMI Permanent Event Subscription severity medium T1047

Back to all Microsoft-Windows-WMI-Activity catalog entries