Potential Suspicious Mofcomp Execution

SIGMA detection rule by Nasreddine Bencherchali (Nextron Systems) · GPL-2.0

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

title: Potential Suspicious Mofcomp Execution
id: 7ff57038-20dd-b144-f4f9-fe2fb075e004
related:
    - id: 1dd05363-104e-4b4a-b963-196a534b03a1
      type: derived
status: test
description: |
    Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
    The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
    Attackers abuse this utility to install malicious MOF scripts
references:
    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
    - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
    - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-12
modified: 2023-04-11
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_img:
        - NewProcessName|endswith: \mofcomp.exe
        - OriginalFileName: mofcomp.exe
    selection_case:
        - ParentProcessName|endswith:
              - \cmd.exe
              - \powershell.exe
              - \pwsh.exe
              - \wsl.exe
              - \wscript.exe
              - \cscript.exe
        - CommandLine|contains:
              - \AppData\Local\Temp
              - \Users\Public\
              - \WINDOWS\Temp\
              - '%temp%'
              - '%tmp%'
              - '%appdata%'
    filter_main_wmiprvse:
        CommandLine|contains: C:\Windows\TEMP\
        CommandLine|endswith: .mof
        ParentProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe
    filter_optional_null_parent:
        # Sometimes the parent information isn't available from the Microsoft-Windows-Security-Auditing provider.
        CommandLine|contains: C:\Windows\TEMP\
        CommandLine|endswith: .mof
    condition: process_creation and (all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*)
falsepositives:
    - Unknown
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5f65f1c7-02d6-4904-9c47-3138b5cb86e3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion