DLL Execution Via Register-cimprovider.exe

Title: DLL Execution Via Register-cimprovider.exe
Status: test
Description:Detects using register-cimprovider.exe to execute arbitrary dll file.
References:
  -https://twitter.com/PhilipTsukerman/status/992021361106268161
  -https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
Date: 2020-10-07
modified:2021-11-27
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\register-cimprovider.exe'
    CommandLine|contains|all:
      -'-path'
      -'dll'

  condition:selection
Falsepositives:
  -Unknown
Level: medium