Registry Manipulation via WMI Stdregprov

Daniel Koifman (KoifSec)

Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

2025-07-30 00:00:00

None

c453ab7a-1f5c-4716-a3b4-dea8135fb43a

attack.persistence attack.execution attack.discovery attack.defense-impairment attack.t1047 attack.t1112 attack.t1012

Community Rule

Nasreddine Bencherchali

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29

phantinuss

chore: ci: bump validator version (#5722)

2025-10-23

Koifman

Merge PR #5567 from @ Koifman - Registry Manipulation via WMI Stdregprov

2025-09-22