Windows WMI StdRegProv Registry Enumeration via wmic.exe
Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-30
- Updated
- 2026-07-30
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of wmic.exe where the command line includes WMI StdRegProv calls to enumerate or read registry data using methods such as EnumKey, EnumValues, GetStringValue, and related read operations. Attackers may use this approach for discovery, retrieving sensitive configuration or credential-adjacent values and installed software details while blending in with legitimate administrative tooling. The detection relies on process creation telemetry, specifically the image path/original filename and the presence of StdRegProv call method strings in the command line.
Reporting behind it
- trustedsec.comhttps://trustedsec.com/blog/command-line-underdog-wmic-in-action
- trustedsec.comhttps://trustedsec.com/blog/wmi-for-script-kiddies
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMI StdRegProv Registry Enumeration via wmic.exe
id: 5501cbc0-e0a0-4839-8026-0589bcdb04e5
related:
- id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
type: similar
- id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191
type: derived
status: experimental
description: This rule identifies process executions of wmic.exe where the command line includes WMI StdRegProv calls to enumerate or read registry data using methods such as EnumKey, EnumValues, GetStringValue, and related read operations. Attackers may use this approach for discovery, retrieving sensitive configuration or credential-adjacent values and installed software details while blending in with legitimate administrative tooling. The detection relies on process creation telemetry, specifically the image path/original filename and the presence of StdRegProv call method strings in the command line.
references:
- https://trustedsec.com/blog/command-line-underdog-wmic-in-action
- https://trustedsec.com/blog/wmi-for-script-kiddies
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-30
modified: 2026-06-19
tags:
- attack.execution
- attack.t1047
- attack.discovery
- attack.t1012
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wmic.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains|all:
- stdregprov
- call
CommandLine|contains:
- CheckAccess
- EnumKey
- EnumValues
- GetBinaryValue
- GetDWORDValue
- GetExpandedStringValue
- GetMultiStringValue
- GetQWORDValue
- GetSecurityDescriptor
- GetStringValue
condition: all of selection_*
falsepositives:
- Legitimate administrative activity
level: medium
license: DRL-1.1