Windows DLL execution via register-cimprovider.exe with -path dll
Alerts on register-cimprovider.exe launching with -path pointing to a DLL.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Ivan Dyachkov, Yulia Fomina, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-07
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of register-cimprovider.exe where the command line includes the -path argument and specifies a .dll file. Attackers can use this pattern to load or register DLLs for execution, supporting persistence, execution, and stealth. The detection relies on Windows process creation telemetry, specifically the executable path and command-line arguments.
Reporting behind it
- twitter.comhttps://twitter.com/PhilipTsukerman/status/992021361106268161
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dll-execution-via-register-cimprovider-exe-with-path-dll-a2910908
title: Windows DLL execution via register-cimprovider.exe with -path dll
id: 27337487-1a54-4fe8-8f73-8003810bdcf2
status: test
description: This rule flags process executions of register-cimprovider.exe where the command line includes the -path argument and specifies a .dll file. Attackers can use this pattern to load or register DLLs for execution, supporting persistence, execution, and stealth. The detection relies on Windows process creation telemetry, specifically the executable path and command-line arguments.
references:
- https://twitter.com/PhilipTsukerman/status/992021361106268161
- https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml
author: Ivan Dyachkov, Yulia Fomina, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \register-cimprovider.exe
CommandLine|contains|all:
- -path
- dll
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a2910908-e86f-4687-aeba-76a5f996e652
type: derived