Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Daniel Koifman (KoifSec) (SigmaHQ), DRL 1.1
Published: 2025-07-30
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Suspicious Registry Value under Console WindowsUpdates for C2 Storage

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

Suspicious Rootkit Configuration Registry Keys (via registry_set)

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmic-registry-changes-via-wmi-stdregprov-write-methods-c453ab7a

title: Windows WMIC Registry Changes via WMI StdRegProv Write Methods
id: ff930a8f-ffe9-4349-a729-2223505cb05d
status: experimental
related:
  - id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191
    type: similar
  - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
    type: derived
description: This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.
references:
  - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
  - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
  - https://trustedsec.com/blog/wmi-for-script-kiddies
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-07-30
modified: 2026-06-19
tags:
  - attack.execution
  - attack.t1047
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains|all:
      - stdregprov
      - call
    CommandLine|contains:
      - CreateKey
      - DeleteKey
      - DeleteValue
      - SetBinaryValue
      - SetDWORDValue
      - SetExpandedStringValue
      - SetMultiStringValue
      - SetQWORDValue
      - SetSecurityDescriptor
      - SetStringValue
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activity
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL