Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

Flags mofcomp.exe runs spawned by script interpreters or using temp/AppData paths, with exclusions for WmiPrvSE .mof-related activity.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-12
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of mofcomp.exe when it is launched as a child of common scripting shells (cmd.exe, PowerShell, pwsh, wsl.exe, wscript.exe, cscript.exe) or when the command line includes suspicious TEMP/AppData locations. It focuses on cases where mofcomp may be used to import attacker-controlled MOF content into the WMI repository. The detection relies on Windows process creation telemetry fields for process image names, parent image paths, and command-line content, and it excludes likely benign invocations tied to WmiPrvSE.exe with specific .mof handling in C:\Windows\TEMP.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths

Pivot detection · T1218 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-suspicious-mofcomp-exe-execution-from-scripts-or-temp-paths-1dd05363

title: "Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths"
id: 214fbe46-31b1-4bf5-b8b6-36b851adbed9
status: test
description: This rule identifies execution of mofcomp.exe when it is launched as a child of common scripting shells (cmd.exe, PowerShell, pwsh, wsl.exe, wscript.exe, cscript.exe) or when the command line includes suspicious TEMP/AppData locations. It focuses on cases where mofcomp may be used to import attacker-controlled MOF content into the WMI repository. The detection relies on Windows process creation telemetry fields for process image names, parent image paths, and command-line content, and it excludes likely benign invocations tied to WmiPrvSE.exe with specific .mof handling in C:\Windows\TEMP.
references:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
  - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2023-04-11
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mofcomp.exe
    - OriginalFileName: mofcomp.exe
  selection_case:
    - ParentImage|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
        - \wsl.exe
        - \wscript.exe
        - \cscript.exe
    - CommandLine|contains:
        - \AppData\Local\Temp
        - \Users\Public\
        - \WINDOWS\Temp\
        - "%temp%"
        - "%tmp%"
        - "%appdata%"
  filter_main_wmiprvse:
    ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe
    CommandLine|contains: C:\Windows\TEMP\
    CommandLine|endswith: .mof
  filter_optional_null_parent:
    CommandLine|contains: C:\Windows\TEMP\
    CommandLine|endswith: .mof
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1dd05363-104e-4b4a-b963-196a534b03a1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL