detection.wiki

Detection rules › Sigma

Registry Manipulation via WMI Stdregprov

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
Daniel Koifman (KoifSec)
Source
github.com/SigmaHQ/sigma

Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry
DiscoveryT1012 Query Registry

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Registry Manipulation via WMI Stdregprov
id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
status: experimental
description: |
    Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class.
    This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
    Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
references:
    - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
    - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
    - https://trustedsec.com/blog/wmi-for-script-kiddies
author: Daniel Koifman (KoifSec)
date: 2025-07-30
tags:
    - attack.persistence
    - attack.execution
    - attack.discovery
    - attack.defense-impairment
    - attack.t1047
    - attack.t1112
    - attack.t1012
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:   # Example command simulated:  WMIC  /NameSpace:\\root\default Class StdRegProv Call CreateKey sSubKeyName=""SOFTWARE\Policies\DeleteMe""
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'call'
            - 'stdregprov'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative activity
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - 'call'
        - 'stdregprov'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • call corpus 8 (sigma 6, splunk 2)
  • stdregprov
Imageends_with
  • \wmic.exe corpus 60 (sigma 60)
OriginalFileNameeq
  • wmic.exe corpus 61 (sigma 36, splunk 18, elastic 7)