{"id":"c453ab7a-1f5c-4716-a3b4-dea8135fb43a","title":"Registry Manipulation via WMI Stdregprov","description":"Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).\nThis behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.\nAttackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.\n","author":"Daniel Koifman (KoifSec)","status":"experimental","level":"medium","date":"2025-07-30","modified":"2026-06-19","tags":["attack.execution","attack.t1047","attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1047","T1112"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrative activity"],"references":["https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again","https://trustedsec.com/blog/command-line-underdog-wmic-in-action","https://trustedsec.com/blog/wmi-for-script-kiddies","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml","source_sha256":"8815e5583148f13a35b5fa40e75e62274a61f81c772c7686afd21a7969a6dbeb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Registry Manipulation via WMI Stdregprov\nid: c453ab7a-1f5c-4716-a3b4-dea8135fb43a\nstatus: experimental\nrelated:\n    - id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 # Registry Enumeration via WMI Stdregprov\n      type: similar\ndescription: |\n    Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).\n    This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.\n    Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.\nreferences:\n    - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again\n    - https://trustedsec.com/blog/command-line-underdog-wmic-in-action\n    - https://trustedsec.com/blog/wmi-for-script-kiddies\n    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov\nauthor: Daniel Koifman (KoifSec)\ndate: 2025-07-30\nmodified: 2026-06-19\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:   # Example command simulated:  WMIC  /NameSpace:\\\\root\\default Class StdRegProv Call CreateKey sSubKeyName=\"\"SOFTWARE\\Policies\\DeleteMe\"\"\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'stdregprov'\n            - 'call'\n        CommandLine|contains:\n            - 'CreateKey'\n            - 'DeleteKey'\n            - 'DeleteValue'\n            - 'SetBinaryValue'\n            - 'SetDWORDValue'\n            - 'SetExpandedStringValue'\n            - 'SetMultiStringValue'\n            - 'SetQWORDValue'\n            - 'SetSecurityDescriptor'\n            - 'SetStringValue'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administrative activity\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/c453ab7a-1f5c-4716-a3b4-dea8135fb43a.json","kind":"sigma"}