Detectionmediumtest

Application Terminated Via Wmic.EXE

Detects calls to the "terminate" function via wmic in order to kill an application

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Mon Sep 1149d9671b-0a0a-4c09-8280-d215bfd30662windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'call'
            - 'terminate'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Techniques

T1047 · Windows Management Instrumentation

Related Rules

DerivedDetectionhigh

Potential Tampering With Security Products Via WMIC

Detects uninstallation or termination of security products using the WMIC utility

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

49d9671b-0a0a-4c09-8280-d215bfd30662

Status

test

Level

medium

Type

Detection

Created

Mon Sep 11

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml

Raw Tags

attack.executionattack.t1047

View on GitHub