Windows: Detect unregmp2.exe used as a proxy to launch wmpnscfg.exe

title: "Windows: Detect unregmp2.exe used as a proxy to launch wmpnscfg.exe"
id: d14f2bb7-2154-4a0b-988c-408d41475597
status: test
description: This rule identifies process creation where unregmp2.exe is launched with command-line content consistent with proxy-style execution (using the /HideWMP argument). Attackers may use this behavior to stealthily run or relay execution through a signed Windows binary, potentially complicating detection of the actual payload activity. The detection relies on Windows process creation telemetry, matching the executable image name/original file name and inspecting the command line for the relevant flag.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml
author: frack113, Huntrule Team
date: 2022-12-29
modified: 2024-06-04
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \unregmp2.exe
    - OriginalFileName: unregmp2.exe
  selection_cmd:
    CommandLine|contains|windash: " /HideWMP"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 727454c0-d851-48b0-8b89-385611ab0704
    type: derived