Encoded Executable Stored in the Registry
Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/11/25"
3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
4maturity = "production"
5min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
6min_stack_version = "8.13.0"
7updated_date = "2024/06/11"
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary
13defense evasion by avoiding the storing of malicious content directly on disk.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*", "logs-sentinel_one_cloud_funnel.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Encoded Executable Stored in the Registry"
20risk_score = 47
21rule_id = "93c1ce76-494c-4f01-8167-35edfb52f7b1"
22severity = "medium"
23tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
24timestamp_override = "event.ingested"
25type = "eql"
26
27query = '''
28registry where host.os.type == "windows" and
29/* update here with encoding combinations */
30 registry.data.strings : "TVqQAAMAAAAEAAAA*"
31'''
32
33
34[[rule.threat]]
35framework = "MITRE ATT&CK"
36[[rule.threat.technique]]
37id = "T1112"
38name = "Modify Registry"
39reference = "https://attack.mitre.org/techniques/T1112/"
40
41[[rule.threat.technique]]
42id = "T1140"
43name = "Deobfuscate/Decode Files or Information"
44reference = "https://attack.mitre.org/techniques/T1140/"
45
46
47[rule.threat.tactic]
48id = "TA0005"
49name = "Defense Evasion"
50reference = "https://attack.mitre.org/tactics/TA0005/"
Related rules
- Port Forwarding Rule Addition
- Mimikatz Memssp Log File Detected
- Persistence via BITS Job Notify Cmdline
- Persistence via Scheduled Job Creation
- Suspicious WerFault Child Process