Windows WMIC Registry Changes via WMI StdRegProv Write Methods
Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.
- Product
- windows
- Category
- process_creation
- Author
- Daniel Koifman (KoifSec) (SigmaHQ), DRL 1.1
- Published
- 2025-07-30
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.
Reporting behind it
- bitdefender.comhttps://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
- trustedsec.comhttps://trustedsec.com/blog/command-line-underdog-wmic-in-action
- trustedsec.comhttps://trustedsec.com/blog/wmi-for-script-kiddies
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC Registry Changes via WMI StdRegProv Write Methods
id: ff930a8f-ffe9-4349-a729-2223505cb05d
status: experimental
related:
- id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191
type: similar
- id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a
type: derived
description: This rule identifies process executions of wmic.exe where the command line includes stdregprov, a call operation, and registry write actions such as CreateKey, DeleteKey, DeleteValue, and multiple Set*Value methods. Such activity matters because it uses WMI’s StdRegProv interface to manipulate registry data, which can bypass monitoring tuned to reg.exe or regedit.exe. It relies on process creation telemetry with Image/original filename matching for wmic.exe and command-line content capturing the StdRegProv call and method names.
references:
- https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
- https://trustedsec.com/blog/command-line-underdog-wmic-in-action
- https://trustedsec.com/blog/wmi-for-script-kiddies
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-07-30
modified: 2026-06-19
tags:
- attack.execution
- attack.t1047
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wmic.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains|all:
- stdregprov
- call
CommandLine|contains:
- CreateKey
- DeleteKey
- DeleteValue
- SetBinaryValue
- SetDWORDValue
- SetExpandedStringValue
- SetMultiStringValue
- SetQWORDValue
- SetSecurityDescriptor
- SetStringValue
condition: all of selection_*
falsepositives:
- Legitimate administrative activity
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml
license: DRL-1.1