Potential Tampering With Security Products Via WMIC

 1title: Potential Tampering With Security Products Via WMIC
 2id: 847d5ff3-8a31-4737-a970-aeae8fe21765
 3related:
 4    - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 # Generic Uninstall
 5      type: derived
 6status: test
 7description: Detects uninstallation or termination of security products using the WMIC utility
 8references:
 9    - https://twitter.com/cglyer/status/1355171195654709249
10    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
11    - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
12    - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
13    - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
14author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
15date: 2021-01-30
16modified: 2025-12-15
17tags:
18    - attack.defense-impairment
19    - attack.t1685
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_cli_1:
25        CommandLine|contains|all:
26            - 'wmic'
27            - 'product '
28            - 'uninstall'
29        CommandLine|contains|windash: '/nointeractive'
30    selection_cli_2:
31        CommandLine|contains|all:
32            - 'wmic'
33            - 'caption like '
34        CommandLine|contains:
35            - 'call delete'
36            - 'call terminate'
37    selection_cli_3:
38        CommandLine|contains|all:
39            - 'process '
40            - 'where '
41            - 'delete'
42    selection_product:
43        CommandLine|contains:
44            - '%carbon%'
45            - '%cylance%'
46            - '%endpoint%'
47            - '%eset%'
48            - '%malware%'
49            - '%Sophos%'
50            - '%symantec%'
51            - 'Antivirus'
52            - 'AVG '
53            - 'Carbon Black'
54            - 'CarbonBlack'
55            - 'Cb Defense Sensor 64-bit'
56            - 'Crowdstrike Sensor'
57            - 'Cylance '
58            - 'Dell Threat Defense'
59            - 'DLP Endpoint'
60            - 'Endpoint Detection'
61            - 'Endpoint Protection'
62            - 'Endpoint Security'
63            - 'Endpoint Sensor'
64            - 'ESET File Security'
65            - 'LogRhythm System Monitor Service'
66            - 'Malwarebytes'
67            - 'McAfee Agent'
68            - 'Microsoft Security Client'
69            - 'Sophos Anti-Virus'
70            - 'Sophos AutoUpdate'
71            - 'Sophos Credential Store'
72            - 'Sophos Management Console'
73            - 'Sophos Management Database'
74            - 'Sophos Management Server'
75            - 'Sophos Remote Management System'
76            - 'Sophos Update Manager'
77            - 'Threat Protection'
78            - 'VirusScan'
79            - 'Webroot SecureAnywhere'
80            - 'Windows Defender'
81    condition: 1 of selection_cli_* and selection_product
82falsepositives:
83    - Legitimate administration
84level: high
85regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products/info.yml