Blue Mockingbird Cryptominer Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

This rule detects attempts to modify system services or WMI settings, which are behaviors associated with the Blue Mockingbird cryptominer. Specifically, it looks for 'sc config' commands that include 'wercplsupporte.dll' and 'wmic.exe' commands ending with 'COR_PROFILER'. These command-line patterns indicate potential persistence or defense evasion mechanisms used by the threat.