Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)

title: Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)
id: 1f2bf33b-18f8-42db-af5e-2875c7c82788
status: test
description: This rule identifies process executions of Xwizard.EXE where the command line contains the RunWizard flag along with a GUID-formatted argument. Attackers can use this behavior to trigger execution paths that rely on COM objects referenced via registry-registered components. The detection relies on Windows process creation telemetry, specifically the full CommandLine string matching the RunWizard marker and a GUID pattern.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
  - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html
  - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-07
modified: 2024-08-15
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: RunWizard
    CommandLine|re: \{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\}
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff
    type: derived