Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

FreeUnreviewedSigmamediumv1

windows-wmic-registry-changes-via-wmi-stdregprov-write-methods-c453ab7a

title: Windows WMIC Registry Changes via WMI StdRegProv Write Methods
id: ff930a8f-ffe9-4349-a729-2223505cb05d
status: experimental
related:
  - id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191
    type: similar
  - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
    type: derived
description: This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.
references:
  - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
  - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
  - https://trustedsec.com/blog/wmi-for-script-kiddies
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-07-30
modified: 2026-06-19
tags:
  - attack.execution
  - attack.t1047
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains|all:
      - stdregprov
      - call
    CommandLine|contains:
      - CreateKey
      - DeleteKey
      - DeleteValue
      - SetBinaryValue
      - SetDWORDValue
      - SetExpandedStringValue
      - SetMultiStringValue
      - SetQWORDValue
      - SetSecurityDescriptor
      - SetStringValue
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activity
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml
license: DRL-1.1

What it detects

This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.