Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

FreeUnreviewedSigmamediumv1

windows-wmi-stdregprov-registry-enumeration-via-wmic-exe-a0e417e2

title: Windows WMI StdRegProv Registry Enumeration via wmic.exe
id: 5501cbc0-e0a0-4839-8026-0589bcdb04e5
related:
  - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
    type: similar
  - id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191
    type: derived
status: experimental
description: This rule identifies process executions of wmic.exe where the command line includes WMI StdRegProv calls to enumerate or read registry data using methods such as EnumKey, EnumValues, GetStringValue, and related read operations. Attackers may use this approach for discovery, retrieving sensitive configuration or credential-adjacent values and installed software details while blending in with legitimate administrative tooling. The detection relies on process creation telemetry, specifically the image path/original filename and the presence of StdRegProv call method strings in the command line.
references:
  - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
  - https://trustedsec.com/blog/wmi-for-script-kiddies
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-30
modified: 2026-06-19
tags:
  - attack.execution
  - attack.t1047
  - attack.discovery
  - attack.t1012
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains|all:
      - stdregprov
      - call
    CommandLine|contains:
      - CheckAccess
      - EnumKey
      - EnumValues
      - GetBinaryValue
      - GetDWORDValue
      - GetExpandedStringValue
      - GetMultiStringValue
      - GetQWORDValue
      - GetSecurityDescriptor
      - GetStringValue
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activity
level: medium
license: DRL-1.1

What it detects

This rule identifies process executions of wmic.exe where the command line includes WMI StdRegProv calls to enumerate or read registry data using methods such as EnumKey, EnumValues, GetStringValue, and related read operations. Attackers may use this approach for discovery, retrieving sensitive configuration or credential-adjacent values and installed software details while blending in with legitimate administrative tooling. The detection relies on process creation telemetry, specifically the image path/original filename and the presence of StdRegProv call method strings in the command line.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.