Potentially Suspicious Mofcomp Execution

 1title: Potentially Suspicious Mofcomp Execution
 2id: 1dd05363-104e-4b4a-b963-196a534b03a1
 3status: test
 4description: |
 5    Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
 6    The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
 7    Attackers abuse this utility to install malicious MOF scripts    
 8references:
 9    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
10    - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
11    - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022-07-12
14modified: 2026-08-06
15tags:
16    - attack.stealth
17    - attack.t1218
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection_img:
23        - Image|endswith: '\mofcomp.exe'
24        - OriginalFileName: 'mofcomp.exe'
25    selection_case:
26        - ParentImage|endswith:
27              - '\cmd.exe'
28              - '\powershell.exe'
29              - '\pwsh.exe'
30              - '\wsl.exe'
31              - '\wscript.exe'
32              - '\cscript.exe'
33        - CommandLine|contains:
34              - '\AppData\Local\Temp'
35              - '\Contacts\'
36              - '\Favorites\'
37              - '\Favourites\'
38              - '\Music\'
39              - '\Pictures\'
40              - '\Users\Public\'
41              - '\Videos\'
42              - '\WINDOWS\Temp\'
43              - '%appdata%'
44              - '%temp%'
45              - '%tmp%'
46    filter_main_wmiprvse:
47        ParentImage: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
48        CommandLine|contains: 'C:\Windows\TEMP\'
49        CommandLine|endswith: '.mof'
50    filter_main_installutil:
51        ParentCommandLine|endswith: '\InstallUtil.exe /Uninstall C:\Windows\CCM\Microsoft.ConfigurationManager.SVProvider.dll'
52        ParentImage|endswith: '\InstallUtil.exe'
53        CommandLine|contains|all:
54            - 'C:\Windows\TEMP'
55            - '.tmp'
56    filter_optional_null_parent:
57        ParentCommandLine: null
58    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
59falsepositives:
60    - Unknown
61level: high