Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)
Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.
- Product
- windows
- Category
- process_creation
- Author
- Trent Liffick (@tliffick) (SigmaHQ), DRL 1.1
- Published
- 2020-05-14
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions attempting to modify system components using the Service Control (sc.exe) utility or the WMI command tool (wmic.exe). It matches sc.exe command lines that include both 'sc config' and 'wercplsupporte.dll', and wmic.exe executions whose command line ends with 'COR_PROFILER'. Such actions can indicate persistence or execution manipulation by loading attacker-controlled modules via configuration changes. The detection relies on process creation telemetry including the executable path (endswith) and command-line content.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)
id: 210b827e-6c42-4421-9525-2a43fa4c5c0d
related:
- id: ce239692-aa94-41b3-b32f-9cab259c96ea
type: merged
- id: c3198a27-23a0-4c2c-af19-e5328d49680e
type: derived
status: test
description: This rule identifies Windows process executions attempting to modify system components using the Service Control (sc.exe) utility or the WMI command tool (wmic.exe). It matches sc.exe command lines that include both 'sc config' and 'wercplsupporte.dll', and wmic.exe executions whose command line ends with 'COR_PROFILER'. Such actions can indicate persistence or execution manipulation by loading attacker-controlled modules via configuration changes. The detection relies on process creation telemetry including the executable path (endswith) and command-line content.
references:
- https://redcanary.com/blog/blue-mockingbird-cryptominer/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml
author: Trent Liffick (@tliffick), Huntrule Team
date: 2020-05-14
modified: 2022-10-09
tags:
- attack.persistence
- attack.execution
- attack.defense-impairment
- attack.t1112
- attack.t1047
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
sc_cmd:
Image|endswith: \cmd.exe
CommandLine|contains|all:
- sc config
- wercplsupporte.dll
wmic_cmd:
Image|endswith: \wmic.exe
CommandLine|endswith: COR_PROFILER
condition: sc_cmd or wmic_cmd
falsepositives:
- Unknown
level: high
license: DRL-1.1