{"id":"c0514f28-fdae-42df-b886-06e2b2bc5b37","title":"Service Startup Type Change Via Wmic.EXE","description":"Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-04-27","modified":"","tags":["attack.execution","attack.defense-impairment","attack.t1047","attack.t1685"],"technique_ids":["T1047","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrative changes to service startup types using WMIC, investigate accordingly."],"references":["https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_service_startup_change.yml","source_sha256":"78160dd4a1e1e602a93fa082e82955bad949c5b4b1bf3a5ce33ebd44fe1f6749","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Service Startup Type Change Via Wmic.EXE\nid: c0514f28-fdae-42df-b886-06e2b2bc5b37\nstatus: experimental\ndescription: |\n    Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.\nreferences:\n    - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-04-27\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1047\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - ' service '\n            - 'ChangeStartMode'\n        CommandLine|contains:\n            - 'Manual'\n            - 'Disabled'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administrative changes to service startup types using WMIC, investigate accordingly.\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/c0514f28-fdae-42df-b886-06e2b2bc5b37.json","kind":"sigma"}