Application Removed Via Wmic.EXE
Uninstall an application with wmic
Sigma rule (View on GitHub)
1title: Application Removed Via Wmic.EXE
2id: b53317a0-8acf-4fd1-8de8-a5401e776b96
3related:
4 - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 # Uninstall Security Products
5 type: derived
6status: test
7description: Uninstall an application with wmic
8references:
9 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic
10author: frack113
11date: 2022/01/28
12modified: 2023/02/14
13tags:
14 - attack.execution
15 - attack.t1047
16logsource:
17 category: process_creation
18 product: windows
19detection:
20 selection_img:
21 - Image|endswith: '\WMIC.exe'
22 - OriginalFileName: 'wmic.exe'
23 selection_cli:
24 CommandLine|contains:
25 - 'call'
26 - 'uninstall'
27 condition: all of selection_*
28falsepositives:
29 - Unknown
30level: medium
References
Related rules
- Computer System Reconnaissance Via Wmic.EXE
- Hardware Model Reconnaissance Via Wmic.EXE
- Potential Product Class Reconnaissance Via Wmic.EXE
- Potential Product Reconnaissance Via Wmic.EXE
- Process Reconnaissance Via Wmic.EXE