Potential Tampering With Security Products Via WMIC

detection:
  selection_cli_1:
    CommandLine|contains|all:
      - 'wmic'
      - 'product '
      - 'uninstall'
    CommandLine|contains|windash: '/nointeractive'
  selection_cli_2:
    CommandLine|contains:
      - 'call delete'
      - 'call terminate'
    CommandLine|contains|all:
      - 'wmic'
      - 'caption like '
  selection_cli_3:
    CommandLine|contains|all:
      - 'process '
      - 'where '
      - 'delete'
  selection_product:
    CommandLine|contains:
      - '%carbon%'
      - '%cylance%'
      - '%endpoint%'
      - '%eset%'
      - '%malware%'
      - '%Sophos%'
      - '%symantec%'
      - 'Antivirus'
      - 'AVG '
      - 'Carbon Black'
      - 'CarbonBlack'
      - 'Cb Defense Sensor 64-bit'
      - 'Crowdstrike Sensor'
      - 'Cylance '
      - 'Dell Threat Defense'
      - 'DLP Endpoint'
      - 'Endpoint Detection'
      - 'Endpoint Protection'
      - 'Endpoint Security'
      - 'Endpoint Sensor'
      - 'ESET File Security'
      - 'LogRhythm System Monitor Service'
      - 'Malwarebytes'
      - 'McAfee Agent'
      - 'Microsoft Security Client'
      - 'Sophos Anti-Virus'
      - 'Sophos AutoUpdate'
      - 'Sophos Credential Store'
      - 'Sophos Management Console'
      - 'Sophos Management Database'
      - 'Sophos Management Server'
      - 'Sophos Remote Management System'
      - 'Sophos Update Manager'
      - 'Threat Protection'
      - 'VirusScan'
      - 'Webroot SecureAnywhere'
      - 'Windows Defender'
  condition: 1 of selection_cli_* and selection_product

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.