Detectionmediumexperimental

Registry Enumeration via WMI Stdregprov

Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Wed Jul 30Updated Fri Jun 19a0e417e2-2fa1-40da-b6d2-e094cd5e1191windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:   # Example command simulated:  WMIC  /NameSpace:\\root\default Class StdRegProv Call EnumKey hDefKey=&H80000002 sSubKeyName="Software\Microsoft\Windows\CurrentVersion\Uninstall"
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'stdregprov'
            - 'call'
        CommandLine|contains:
            - 'CheckAccess'
            - 'EnumKey'
            - 'EnumValues'
            - 'GetBinaryValue'
            - 'GetDWORDValue'
            - 'GetExpandedStringValue'
            - 'GetMultiStringValue'
            - 'GetQWORDValue'
            - 'GetSecurityDescriptor'
            - 'GetStringValue'
    condition: all of selection_*

False Positives

Legitimate administrative activity

References

MITRE ATT&CK

Tactics

TA0002 · Execution TA0007 · Discovery

Techniques

T1047 · Windows Management Instrumentation T1012 · Query Registry

Related Rules

SimilarDetectionmedium

Registry Manipulation via WMI Stdregprov

Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.). This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

a0e417e2-2fa1-40da-b6d2-e094cd5e1191

Status

experimental

Level

medium

Type

Detection

Created

Wed Jul 30

Modified

Fri Jun 19

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml

Raw Tags

attack.executionattack.t1047attack.discoveryattack.t1012

View on GitHub