Suspicious Autorun Registry Modified via WMI

Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_execution_img`

or:
Image|endswith: '\wmic.exe'
OriginalFileName: wmic.exe
ParentImage|endswith: '\wmiprvse.exe'

Stage 2: `all of selection_execution_cmd`

or:
CommandLine|contains: '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
CommandLine|contains: '\Software\Microsoft\Windows\CurrentVersion\Run'
CommandLine|contains: '\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
CommandLine|contains: ' add '
CommandLine|contains: reg

Stage 3: `selection_suspicious_paths_1`

or:
CommandLine|contains: '%AppData%'
CommandLine|contains: '%Public%'
CommandLine|contains: '%temp%'
CommandLine|contains: '%tmp%'
CommandLine|contains: ':\$Recycle.bin'
CommandLine|contains: ':\Perflogs'
CommandLine|contains: ':\ProgramData'''
CommandLine|contains: ':\Temp'
CommandLine|contains: ':\Users\Default'
CommandLine|contains: ':\Users\public'
CommandLine|contains: ':\Windows\Temp'
CommandLine|contains: '\AppData\Local\Temp'
CommandLine|contains: '\AppData\Roaming'

Stage 4: `all of selection_suspicious_paths_user_1`

CommandLine|contains: ':\Users\'

Stage 5: `all of selection_suspicious_paths_user_2`

or:
CommandLine|contains: '\Contacts'
CommandLine|contains: '\Documents'
CommandLine|contains: '\Favorites'
CommandLine|contains: '\Favourites'
CommandLine|contains: '\Music'
CommandLine|contains: '\Photos'
CommandLine|contains: '\Pictures'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`add` corpus 11 (sigma 11) `%AppData%` corpus 7 (sigma 7) `%Public%` corpus 4 (sigma 4) `%temp%` corpus 5 (sigma 5) `%tmp%` corpus 9 (sigma 9) `:\$Recycle.bin` `:\Perflogs` corpus 3 (sigma 3) `:\ProgramData'` `:\Temp` `:\Users\` corpus 6 (sigma 6) `:\Users\Default` `:\Users\public` `:\Windows\Temp` corpus 2 (sigma 2) `\AppData\Local\Temp` corpus 8 (sigma 8) `\AppData\Roaming` `\Contacts` `\Documents` `\Favorites` `\Favourites` `\Music` `\Photos` `\Pictures` `\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run` corpus 2 (sigma 2) `\Software\Microsoft\Windows\CurrentVersion\Run` `\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run` corpus 2 (sigma 2) `reg` corpus 4 (sigma 4)
`Image`	ends_with	`\wmic.exe` corpus 37 (sigma 37)
`OriginalFileName`	eq	`wmic.exe` corpus 33 (sigma 33)
`ParentImage`	ends_with	`\wmiprvse.exe` corpus 3 (sigma 3)

Suspicious Autorun Registry Modified via WMI

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_execution_img

Stage 2: all of selection_execution_cmd

Stage 3: selection_suspicious_paths_1