Windows Persistence: WMIC Used to Add Run Registry Values via reg.exe

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

FreeUnreviewedSigmahighv1

windows-persistence-wmic-used-to-add-run-registry-values-via-reg-exe-c80e66d8

title: "Windows Persistence: WMIC Used to Add Run Registry Values via reg.exe"
id: 174de910-e759-4513-a68c-5d73ce894596
status: experimental
description: This rule identifies process creation where WMIC (wmic.exe) is launched by the WMI provider (wmiprvse.exe) and its command line invokes reg.exe to add registry values under common Run key locations. Such behavior can indicate malware attempting persistence by creating autorun entries in per-user or policy-controlled registry paths. The detection relies on Windows process creation telemetry, matching image relationships, command-line content for reg.exe add operations, and suspicious command-line paths commonly used for executable staging.
references:
  - Internal Research
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_autorun_registry_modified_via_wmic.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-17
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1547.001
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_execution_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
    - ParentImage|endswith: \wmiprvse.exe
  selection_execution_cmd:
    CommandLine|contains|all:
      - reg
      - " add "
    CommandLine|contains:
      - \Software\Microsoft\Windows\CurrentVersion\Run
      - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
      - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  selection_suspicious_paths_1:
    CommandLine|contains:
      - :\Perflogs
      - :\ProgramData'
      - :\Windows\Temp
      - :\Temp
      - \AppData\Local\Temp
      - \AppData\Roaming
      - :\$Recycle.bin
      - :\Users\Default
      - :\Users\public
      - "%temp%"
      - "%tmp%"
      - "%Public%"
      - "%AppData%"
  selection_suspicious_paths_user_1:
    CommandLine|contains: :\Users\
  selection_suspicious_paths_user_2:
    CommandLine|contains:
      - \Favorites
      - \Favourites
      - \Contacts
      - \Music
      - \Pictures
      - \Documents
      - \Photos
  condition: all of selection_execution_* and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_*))
falsepositives:
  - Legitimate administrative activity or software installations
level: high
license: DRL-1.1
related:
  - id: c80e66d8-1780-48a9-b412-46663fd21ac0
    type: derived

What it detects

This rule identifies process creation where WMIC (wmic.exe) is launched by the WMI provider (wmiprvse.exe) and its command line invokes reg.exe to add registry values under common Run key locations. Such behavior can indicate malware attempting persistence by creating autorun entries in per-user or policy-controlled registry paths. The detection relies on Windows process creation telemetry, matching image relationships, command-line content for reg.exe add operations, and suspicious command-line paths commonly used for executable staging.

Known false positives

Legitimate administrative activity or software installations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.