Windows DLL execution via register-cimprovider.exe with -path dll

title: Windows DLL execution via register-cimprovider.exe with -path dll
id: 27337487-1a54-4fe8-8f73-8003810bdcf2
status: test
description: This rule flags process executions of register-cimprovider.exe where the command line includes the -path argument and specifies a .dll file. Attackers can use this pattern to load or register DLLs for execution, supporting persistence, execution, and stealth. The detection relies on Windows process creation telemetry, specifically the executable path and command-line arguments.
references:
  - https://twitter.com/PhilipTsukerman/status/992021361106268161
  - https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml
author: Ivan Dyachkov, Yulia Fomina, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \register-cimprovider.exe
    CommandLine|contains|all:
      - -path
      - dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a2910908-e86f-4687-aeba-76a5f996e652
    type: derived