Sigma rule: Registry Manipulation via WMI Stdregprov

Rule

Title

Registry Manipulation via WMI Stdregprov

Status

experimental

Level

medium

Author

Daniel Koifman (KoifSec)

Date

2025-07-30

Modified

2026-06-19

File

rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

Log source

product

windows

category

process_creation

Detection

selection_img:   # Example command simulated:  WMIC  /NameSpace:\\root\default Class StdRegProv Call CreateKey sSubKeyName=""SOFTWARE\Policies\DeleteMe""
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
selection_cli:
    CommandLine|contains|all:
        - 'stdregprov'
        - 'call'
    CommandLine|contains:
        - 'CreateKey'
        - 'DeleteKey'
        - 'DeleteValue'
        - 'SetBinaryValue'
        - 'SetDWORDValue'
        - 'SetExpandedStringValue'
        - 'SetMultiStringValue'
        - 'SetQWORDValue'
        - 'SetSecurityDescriptor'
        - 'SetStringValue'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate administrative activity

Tags

• attack.execution
• attack.t1047
• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1047
• T1112

Related rules

• a0e417e2-2fa1-40da-b6d2-e094cd5e1191 (similar)

References

• https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
• https://trustedsec.com/blog/command-line-underdog-wmic-in-action
• https://trustedsec.com/blog/wmi-for-script-kiddies
• https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml