Suspicious Application Termination Attempt through Wmic.EXE (via process_creation)

title: Suspicious Application Termination Attempt through Wmic.EXE (via process_creation)
id: b3e689a3-1f48-54ec-8274-faaaa234c585
status: stable
description: This rule detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Threat actors may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/
    - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
author: Huntrule Team
date: 2026-01-20
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'call'
            - 'terminate'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_terminate_application/info.yml