Application Removed Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•13

Detects the removal or uninstallation of an application via "Wmic.EXE" using the 'call uninstall' command line arguments. This activity can be indicative of an adversary attempting to remove security software or other applications to hinder defensive capabilities or clean up traces.