Query: rule covering Detects uninstallation or termination of security products using the WMIC utility
Matching passage: Sigma rule: Detects uninstallation or termination of security products using the WMIC utility. Logsource: windows / process_creation. Rule: title: Potential Tampering With Security Products Via WMIC id: 847d5ff3-8a31-4737-a970-aeae8fe21765 related: - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 type: derived status: test description: Detects uninstallation or termination of security products using the WMIC utility references: - https://twitter.com/cglyer/status/1355171195654709249 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-01-30 modified: 2025-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cli_1: CommandLine|contains|all: - wmic - 'product ' - uninstall CommandLine|contains|windash: /nointeractive selection_cli_2: CommandLine|contains|all: - wmic - 'caption like ' CommandLine|contains: - call delete - call terminate selection_cli_3: CommandLine|contains|all: - 'process ' - 'where ' - delete selection_product: CommandLine|contains: - '%carbon%' - '%cylance%' - '%endpoint%' - '%eset%' - '%malware%' - '%Sophos%' - '%symantec%' - Antivirus - 'AVG ' - Carbon Black - CarbonBlack - Cb Defense Sensor 64-bit - Crowdstrike Sensor - 'Cylance ' - Dell Threat Defense - DLP Endpoint - Endpoint Detection - Endpoint Protection - Endpoint Security - Endpoint Sensor - ESET File Security - LogRhythm System Monitor Service - Malwarebytes - McAfee Agent - Microsoft Security Client - Sophos Anti-Virus - Sophos AutoUpdate - Sophos Credential Store - Sophos Management Console - Sophos Management Database - Sophos Management Server - Sophos Remote Management System - Sophos Update Manager - Threat Protection - VirusScan - Webroot SecureAnywhere - Windows Defender condition: 1 of selection_cli_* and selection_product falsepositives: - Legitimate administration level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products/info.yml
Near-miss passage: Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium