Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

title: "Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths"
id: 214fbe46-31b1-4bf5-b8b6-36b851adbed9
status: test
description: This rule identifies execution of mofcomp.exe when it is launched as a child of common scripting shells (cmd.exe, PowerShell, pwsh, wsl.exe, wscript.exe, cscript.exe) or when the command line includes suspicious TEMP/AppData locations. It focuses on cases where mofcomp may be used to import attacker-controlled MOF content into the WMI repository. The detection relies on Windows process creation telemetry fields for process image names, parent image paths, and command-line content, and it excludes likely benign invocations tied to WmiPrvSE.exe with specific .mof handling in C:\Windows\TEMP.
references:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
  - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2023-04-11
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mofcomp.exe
    - OriginalFileName: mofcomp.exe
  selection_case:
    - ParentImage|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wsl.exe
        - \wscript.exe
        - \cscript.exe
    - CommandLine|contains:
        - \AppData\Local\Temp
        - \Users\Public\
        - \WINDOWS\Temp\
        - "%temp%"
        - "%tmp%"
        - "%appdata%"
  filter_main_wmiprvse:
    ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe
    CommandLine|contains: C:\Windows\TEMP\
    CommandLine|endswith: .mof
  filter_optional_null_parent:
    CommandLine|contains: C:\Windows\TEMP\
    CommandLine|endswith: .mof
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1dd05363-104e-4b4a-b963-196a534b03a1
    type: derived