{"id":"847d5ff3-8a31-4737-a970-aeae8fe21765","title":"Potential Tampering With Security Products Via WMIC","description":"Detects uninstallation or termination of security products using the WMIC utility","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-01-30","modified":"2025-12-15","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administration"],"references":["https://twitter.com/cglyer/status/1355171195654709249","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/","https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions","https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/","https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml","source_sha256":"1af18de13acec8ca16fe328ca0e9f342ba60f1aa2d238b46d79953ff95f40c9d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Tampering With Security Products Via WMIC\nid: 847d5ff3-8a31-4737-a970-aeae8fe21765\nrelated:\n    - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 # Generic Uninstall\n      type: derived\nstatus: test\ndescription: Detects uninstallation or termination of security products using the WMIC utility\nreferences:\n    - https://twitter.com/cglyer/status/1355171195654709249\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions\n    - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/\n    - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-01-30\nmodified: 2025-12-15\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cli_1:\n        CommandLine|contains|all:\n            - 'wmic'\n            - 'product '\n            - 'uninstall'\n        CommandLine|contains|windash: '/nointeractive'\n    selection_cli_2:\n        CommandLine|contains|all:\n            - 'wmic'\n            - 'caption like '\n        CommandLine|contains:\n            - 'call delete'\n            - 'call terminate'\n    selection_cli_3:\n        CommandLine|contains|all:\n            - 'process '\n            - 'where '\n            - 'delete'\n    selection_product:\n        CommandLine|contains:\n            - '%carbon%'\n            - '%cylance%'\n            - '%endpoint%'\n            - '%eset%'\n            - '%malware%'\n            - '%Sophos%'\n            - '%symantec%'\n            - 'Antivirus'\n            - 'AVG '\n            - 'Carbon Black'\n            - 'CarbonBlack'\n            - 'Cb Defense Sensor 64-bit'\n            - 'Crowdstrike Sensor'\n            - 'Cylance '\n            - 'Dell Threat Defense'\n            - 'DLP Endpoint'\n            - 'Endpoint Detection'\n            - 'Endpoint Protection'\n            - 'Endpoint Security'\n            - 'Endpoint Sensor'\n            - 'ESET File Security'\n            - 'LogRhythm System Monitor Service'\n            - 'Malwarebytes'\n            - 'McAfee Agent'\n            - 'Microsoft Security Client'\n            - 'Sophos Anti-Virus'\n            - 'Sophos AutoUpdate'\n            - 'Sophos Credential Store'\n            - 'Sophos Management Console'\n            - 'Sophos Management Database'\n            - 'Sophos Management Server'\n            - 'Sophos Remote Management System'\n            - 'Sophos Update Manager'\n            - 'Threat Protection'\n            - 'VirusScan'\n            - 'Webroot SecureAnywhere'\n            - 'Windows Defender'\n    condition: 1 of selection_cli_* and selection_product\nfalsepositives:\n    - Legitimate administration\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/847d5ff3-8a31-4737-a970-aeae8fe21765.json","kind":"sigma"}