Registry Manipulation via WMI Stdregprov

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: Daniel Koifman (KoifSec)
Source: github.com/SigmaHQ/sigma

Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.). This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

Known false positives

Legitimate administrative activity

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Registry Manipulation via WMI Stdregprov
id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
status: experimental
related:
    - id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 # Registry Enumeration via WMI Stdregprov
      type: similar
description: |
    Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).
    This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
    Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
references:
    - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
    - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
    - https://trustedsec.com/blog/wmi-for-script-kiddies
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
author: Daniel Koifman (KoifSec)
date: 2025-07-30
modified: 2026-06-19
tags:
    - attack.execution
    - attack.t1047
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:   # Example command simulated:  WMIC  /NameSpace:\\root\default Class StdRegProv Call CreateKey sSubKeyName=""SOFTWARE\Policies\DeleteMe""
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'stdregprov'
            - 'call'
        CommandLine|contains:
            - 'CreateKey'
            - 'DeleteKey'
            - 'DeleteValue'
            - 'SetBinaryValue'
            - 'SetDWORDValue'
            - 'SetExpandedStringValue'
            - 'SetMultiStringValue'
            - 'SetQWORDValue'
            - 'SetSecurityDescriptor'
            - 'SetStringValue'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative activity
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'stdregprov'
        - 'call'
    CommandLine|contains:
        - 'CreateKey'
        - 'DeleteKey'
        - 'DeleteValue'
        - 'SetBinaryValue'
        - 'SetDWORDValue'
        - 'SetExpandedStringValue'
        - 'SetMultiStringValue'
        - 'SetQWORDValue'
        - 'SetSecurityDescriptor'
        - 'SetStringValue'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`CreateKey` `DeleteKey` `DeleteValue` corpus 2 (sigma 2) `SetBinaryValue` `SetDWORDValue` `SetExpandedStringValue` `SetMultiStringValue` `SetQWORDValue` `SetSecurityDescriptor` `SetStringValue` `call` corpus 8 (sigma 6, splunk 2) `stdregprov` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\wmic.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`