Suspicious Registry Manipulation through WMI Stdregprov (via process_creation)

title: Suspicious Registry Manipulation through WMI Stdregprov (via process_creation)
id: 068681b1-af1d-5ca5-a8a1-460fd054a7bf
status: stable
description: This rule detects the use of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.). This behaviour could be potentially anomalous because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this method to evade detection and bypass security monitoring focused on traditional registry modification commands.
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://attack.mitre.org/techniques/T1047/
    - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
    - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
    - https://trustedsec.com/blog/wmi-for-script-kiddies
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
author: Huntrule Team
date: 2026-02-07
tags:
    - attack.execution
    - attack.t1047
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'stdregprov'
            - 'call'
        CommandLine|contains:
            - 'CreateKey'
            - 'DeleteKey'
            - 'DeleteValue'
            - 'SetBinaryValue'
            - 'SetDWORDValue'
            - 'SetExpandedStringValue'
            - 'SetMultiStringValue'
            - 'SetQWORDValue'
            - 'SetSecurityDescriptor'
            - 'SetStringValue'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml