Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type
Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-04-27
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions of wmic.exe where the command includes service ChangeStartMode and sets the startup type to either Manual or Disabled. Attackers and legitimate admins can use startup type changes to impair defenses or persist with reduced visibility, so startup-type tampering is an important indicator. The detection relies on process creation telemetry, matching the WMIC executable and the specific command-line parameters indicating the startup mode change.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type"
id: a23c4f65-1049-473d-8017-ae716b4f8c4b
status: experimental
description: This rule flags Windows process executions of wmic.exe where the command includes service ChangeStartMode and sets the startup type to either Manual or Disabled. Attackers and legitimate admins can use startup type changes to impair defenses or persist with reduced visibility, so startup-type tampering is an important indicator. The detection relies on process creation telemetry, matching the WMIC executable and the specific command-line parameters indicating the startup mode change.
references:
- https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-27
tags:
- attack.execution
- attack.defense-impairment
- attack.t1047
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \WMIC.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains|all:
- " service "
- ChangeStartMode
CommandLine|contains:
- Manual
- Disabled
condition: all of selection_*
falsepositives:
- Legitimate administrative changes to service startup types using WMIC, investigate accordingly.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml
license: DRL-1.1
related:
- id: c0514f28-fdae-42df-b886-06e2b2bc5b37
type: derived