huntrule

Windows wmic.exe Used to Start or Stop Services

Alerts on wmic.exe command lines invoking startservice or stopservice via service calls.

FreeUnreviewedSigmamediumv1
title: Windows wmic.exe Used to Start or Stop Services
id: 76535ab4-d781-4f44-b5b7-7518dad14689
status: test
description: This rule flags process creation events where wmic.exe is used with command-line arguments that include the service call workflow and either stopservice or startservice. Attackers may use wmic to manipulate service state as part of execution, persistence, or administrative abuse. The detection relies on Windows process creation telemetry, matching the image name/path and specific command-line substrings.
references:
  - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-02-14
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: wmic.exe
    - Image|endswith: \WMIC.exe
  selection_cli:
    CommandLine|contains|all:
      - " service "
      - " call "
    CommandLine|contains:
      - stopservice
      - startservice
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation/info.yml
license: DRL-1.1
related:
  - id: 0b7163dc-7eee-4960-af17-c0cd517f92da
    type: derived

What it detects

This rule flags process creation events where wmic.exe is used with command-line arguments that include the service call workflow and either stopservice or startservice. Attackers may use wmic to manipulate service state as part of execution, persistence, or administrative abuse. The detection relies on Windows process creation telemetry, matching the image name/path and specific command-line substrings.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.