Windows: Service/COM hijack attempts via sc.exe and wmic.exe (Blue Mockingbird)

Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.

FreeUnreviewedSigmahighv1

windows-service-com-hijack-attempts-via-sc-exe-and-wmic-exe-blue-mockingbird-c3198a27

title: "Windows: Service/COM hijack attempts via sc.exe and wmic.exe (Blue Mockingbird)"
id: 210b827e-6c42-4421-9525-2a43fa4c5c0d
related:
  - id: ce239692-aa94-41b3-b32f-9cab259c96ea
    type: merged
  - id: c3198a27-23a0-4c2c-af19-e5328d49680e
    type: derived
status: test
description: This rule identifies Windows process executions that modify system configuration using sc.exe (sc config) to reference wercplsupporte.dll, or using wmic.exe to set a COR_PROFILER value. Such actions can indicate persistence or defense-impairment techniques by changing how components load or run on the host. It relies on Windows process creation telemetry with fields for the executable path and command line arguments.
references:
  - https://redcanary.com/blog/blue-mockingbird-cryptominer/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml
author: Trent Liffick (@tliffick), Huntrule Team
date: 2020-05-14
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - attack.t1047
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  sc_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - sc config
      - wercplsupporte.dll
  wmic_cmd:
    Image|endswith: \wmic.exe
    CommandLine|endswith: COR_PROFILER
  condition: sc_cmd or wmic_cmd
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process executions that modify system configuration using sc.exe (sc config) to reference wercplsupporte.dll, or using wmic.exe to set a COR_PROFILER value. Such actions can indicate persistence or defense-impairment techniques by changing how components load or run on the host. It relies on Windows process creation telemetry with fields for the executable path and command line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.