Title:
Service Startup Type Change Via Wmic.EXE
Status:
experimental
Description:Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
References:
-https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-27
modified:None
Tags:
- -'attack.execution'
- -'attack.defense-impairment'
- -'attack.t1047'
- -'attack.t1685'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Image|endswith:
'\WMIC.exe'
OriginalFileName:
'wmic.exe'
selection_cli:
CommandLine|contains|all:
-' service '
-'ChangeStartMode'
CommandLine|contains:
-'Manual'
-'Disabled'
condition:
all of selection_*
Falsepositives:
-Legitimate administrative changes to service startup types using WMIC, investigate accordingly.
Level:
medium
