Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Trent Liffick (@tliffick) (SigmaHQ), DRL 1.1
Published: 2020-05-14
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions attempting to modify system components using the Service Control (sc.exe) utility or the WMI command tool (wmic.exe). It matches sc.exe command lines that include both 'sc config' and 'wercplsupporte.dll', and wmic.exe executions whose command line ends with 'COR_PROFILER'. Such actions can indicate persistence or execution manipulation by loading attacker-controlled modules via configuration changes. The detection relies on process creation telemetry including the executable path (endswith) and command-line content.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

Malicious Impacket wmiexec Command Execution via WmiPrvSE Spawning cmd with Admin-Share Output Redirect (via process_creation)

Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)

Malicious Remote Payload Deployment via WMIC Node Process Call Create with bitsadmin Transfer (via process_creation)

Malicious WMIexec Style Command Output Redirection to Local Admin Share

Suspicious Registry Value under Console WindowsUpdates for C2 Storage

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Pivot detection · T1047 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-com-hijack-attempts-via-sc-exe-and-wmic-exe-blue-mockingbird-c3198a27

title: Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)
id: 210b827e-6c42-4421-9525-2a43fa4c5c0d
related:
  - id: ce239692-aa94-41b3-b32f-9cab259c96ea
    type: merged
  - id: c3198a27-23a0-4c2c-af19-e5328d49680e
    type: derived
status: test
description: This rule identifies Windows process executions attempting to modify system components using the Service Control (sc.exe) utility or the WMI command tool (wmic.exe). It matches sc.exe command lines that include both 'sc config' and 'wercplsupporte.dll', and wmic.exe executions whose command line ends with 'COR_PROFILER'. Such actions can indicate persistence or execution manipulation by loading attacker-controlled modules via configuration changes. The detection relies on process creation telemetry including the executable path (endswith) and command-line content.
references:
  - https://redcanary.com/blog/blue-mockingbird-cryptominer/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml
author: Trent Liffick (@tliffick), Huntrule Team
date: 2020-05-14
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - attack.t1047
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  sc_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - sc config
      - wercplsupporte.dll
  wmic_cmd:
    Image|endswith: \wmic.exe
    CommandLine|endswith: COR_PROFILER
  condition: sc_cmd or wmic_cmd
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL