{"id":"49d9671b-0a0a-4c09-8280-d215bfd30662","title":"Application Termination Attempt via Wmic.EXE","description":"Detects an attempt to terminate a process via \"wmic\" with the \"call terminate\" flag. Adversaries may\nuse wmic to terminate security products or other applications on the compromised host. This event is\ntriggered on on attempt and process creation can be either successful or unsuccessful.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-11","modified":"","tags":["attack.execution","attack.t1047"],"technique_ids":["T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/","https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml","source_sha256":"9c5a17cdebc6c32ea6c49f13324c34a77d229d9e073ab9f5c9f87b1569b04904","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Application Termination Attempt via Wmic.EXE\nid: 49d9671b-0a0a-4c09-8280-d215bfd30662\nrelated:\n    - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 # Uninstall Security Products\n      type: derived\nstatus: test\ndescription: |\n    Detects an attempt to terminate a process via \"wmic\" with the \"call terminate\" flag. Adversaries may\n    use wmic to terminate security products or other applications on the compromised host. This event is\n    triggered on on attempt and process creation can be either successful or unsuccessful.\nreferences:\n    - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-09-11\ntags:\n    - attack.execution\n    - attack.t1047\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'call'\n            - 'terminate'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_terminate_application/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/49d9671b-0a0a-4c09-8280-d215bfd30662.json","kind":"sigma"}