id: 2ade7598-4cca-4bb1-aed5-b69bf64000ce
description: N/A
date: 2026-01-07
author: Swachchhanda Shrawan Poudel (Nextron Systems)
rule_metadata:
    - id: c0514f28-fdae-42df-b886-06e2b2bc5b37
      title: Service Startup Type Change Via WMIC
regression_tests_info:
    - name: Positive Detection Test
      type: evtx
      provider: Microsoft-Windows-Sysmon
      match_count: 1
      path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/c0514f28-fdae-42df-b886-06e2b2bc5b37.evtx
