huntrule

Windows DLL execution via register-cimprovider.exe with -path dll

Alerts on register-cimprovider.exe launching with -path pointing to a DLL.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Ivan Dyachkov, Yulia Fomina, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of register-cimprovider.exe where the command line includes the -path argument and specifies a .dll file. Attackers can use this pattern to load or register DLLs for execution, supporting persistence, execution, and stealth. The detection relies on Windows process creation telemetry, specifically the executable path and command-line arguments.

Reporting behind it

Related detections8 linkedT1574 — drag to rearrange
Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit
Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders
Windows Registry Persistence: DbgManagedDebugger Debugger Value Added
Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)
Windows ImageLoad of DLL from spoolsv.exe spool drivers subfolders
Windows Registry Printer Driver Installations with Empty Manufacturer Field
Windows Process Creation: Suspicious SetupComplete.cmd execution for CVE-2019-1378 exploitation
Windows regsvr32 Executes DLL with Uncommon Extension in Command Line
Windows DLL execution via register-cimprovider.exe with -path dll
Pivot detection · T1574 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.