Sigma rule: Potential Tampering With Security Products Via WMIC

Rule

Title

Potential Tampering With Security Products Via WMIC

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2021-01-30

Modified

2025-12-15

File

rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects uninstallation or termination of security products using the WMIC utility

Log source

product

windows

category

process_creation

Detection

selection_cli_1:
    CommandLine|contains|all:
        - 'wmic'
        - 'product '
        - 'uninstall'
    CommandLine|contains|windash: '/nointeractive'
selection_cli_2:
    CommandLine|contains|all:
        - 'wmic'
        - 'caption like '
    CommandLine|contains:
        - 'call delete'
        - 'call terminate'
selection_cli_3:
    CommandLine|contains|all:
        - 'process '
        - 'where '
        - 'delete'
selection_product:
    CommandLine|contains:
        - '%carbon%'
        - '%cylance%'
        - '%endpoint%'
        - '%eset%'
        - '%malware%'
        - '%Sophos%'
        - '%symantec%'
        - 'Antivirus'
        - 'AVG '
        - 'Carbon Black'
        - 'CarbonBlack'
        - 'Cb Defense Sensor 64-bit'
        - 'Crowdstrike Sensor'
        - 'Cylance '
        - 'Dell Threat Defense'
        - 'DLP Endpoint'
        - 'Endpoint Detection'
        - 'Endpoint Protection'
        - 'Endpoint Security'
        - 'Endpoint Sensor'
        - 'ESET File Security'
        - 'LogRhythm System Monitor Service'
        - 'Malwarebytes'
        - 'McAfee Agent'
        - 'Microsoft Security Client'
        - 'Sophos Anti-Virus'
        - 'Sophos AutoUpdate'
        - 'Sophos Credential Store'
        - 'Sophos Management Console'
        - 'Sophos Management Database'
        - 'Sophos Management Server'
        - 'Sophos Remote Management System'
        - 'Sophos Update Manager'
        - 'Threat Protection'
        - 'VirusScan'
        - 'Webroot SecureAnywhere'
        - 'Windows Defender'
condition: 1 of selection_cli_* and selection_product

False positives (as the rule lists them)

• Legitimate administration

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

Related rules

• b53317a0-8acf-4fd1-8de8-a5401e776b96 (derived)

References

• https://twitter.com/cglyer/status/1355171195654709249
• https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
• https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
• https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
• https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml