attack.t1047 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Application Removed Via Wmic.EXE · sigma-rule
• Application Termination Attempt via Wmic.EXE · sigma-rule
• Computer System Reconnaissance Via Wmic.EXE · sigma-rule
• HackTool - CrackMapExec Execution · sigma-rule
• HackTool - CrackMapExec Execution Patterns · sigma-rule
• HackTool - Potential Impacket Lateral Movement Activity · sigma-rule
• Hardware Model Reconnaissance Via Wmic.EXE · sigma-rule
• HTML Help HH.EXE Suspicious Child Process · sigma-rule
• MITRE BZAR Indicators for Execution · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Potential Process Reconnaissance via Wmic.EXE · sigma-rule
• Potential Product Class Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Product Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Remote SquiblyTwo Technique Execution · sigma-rule
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Windows Defender Tampering Via Wmic.EXE · sigma-rule
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell · sigma-rule
• Process Creation Attempt via Wmic.EXE · sigma-rule
• PSExec and WMI Process Creations Block · sigma-rule
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · sigma-rule
• Registry Enumeration via WMI Stdregprov · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Remote DCOM/WMI Lateral Movement · sigma-rule
• Script Event Consumer Spawning Process · sigma-rule
• Service Reconnaissance Via Wmic.EXE · sigma-rule
• Service Started/Stopped Via Wmic.EXE · sigma-rule
• Service Startup Type Change Via Wmic.EXE · sigma-rule
• Successful Account Login Via WMI · sigma-rule
• Suspicious Autorun Registry Modified via WMI · sigma-rule
• Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
• Suspicious HH.EXE Execution · sigma-rule
• Suspicious Microsoft Office Child Process · sigma-rule
• Suspicious Process Created Via Wmic.EXE · sigma-rule
• Suspicious WMIC Execution Via Office Process · sigma-rule
• Suspicious WmiPrvSE Child Process · sigma-rule
• System Disk And Volume Reconnaissance Via Wmic.EXE · sigma-rule
• T1047 Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE · sigma-rule
• WMI Event Consumer Created Named Pipe · sigma-rule
• WMIC Remote Command Execution · sigma-rule
• WMIC Unquoted Services Path Lookup - PowerShell · sigma-rule
• Wmiexec Default Output File · sigma-rule
• WMImplant Hack Tool · sigma-rule
• WmiPrvSE Spawned A Process · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack - File · sigma-rule
• XSL Script Execution Via WMIC.EXE · sigma-rule