Potential Uninstall Entry Concealment

  1[metadata]
  2creation_date = "2026/09/17"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/17"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies execution of the Hide From Uninstall List utility or a registry change that marks an installed application as
 11a system component, causing Windows to omit it from Programs and Features. Adversaries may use either method to conceal
 12remote-access, security, or other software.
 13"""
 14false_positives = [
 15    """
 16    Application installers, software-management systems, and administrators may legitimately set SystemComponent during
 17    deployment, updates, packaging, or shared-device and kiosk hardening. Confirm the matched branch, binary or
 18    uninstall target, initiating identity, host, parent process, and change window against the change record before
 19    adding a narrow exception.
 20    """,
 21]
 22from = "now-9m"
 23index = [
 24    "logs-endpoint.events.process-*",
 25    "logs-endpoint.events.registry-*",
 26    "logs-windows.sysmon_operational-*",
 27    "winlogbeat-*",
 28]
 29interval = "5m"
 30language = "eql"
 31license = "Elastic License v2"
 32name = "Potential Uninstall Entry Concealment"
 33references = [
 34    "https://www.huntress.com/blog/daisy-chaining-rogue-rmm-tools",
 35    "https://www.huntress.com/blog/phishing-bitb-rmm-attacks",
 36    "https://www.safebreach.com/blog/ragnarlocker-ransomware-lokilocker-threat-coverage/",
 37    "https://www.sygnia.co/blog/threat-actor-spotlight-ragnarlocker-ransomware/",
 38    "https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access",
 39    "https://cofense.com/blog/the-evolution-of-remote-access-tool-abuse",
 40    "https://learn.microsoft.com/en-us/windows/win32/msi/arpsystemcomponent",
 41    "https://www.sordum.org/11081/hide-from-uninstall-list-v1-1/",
 42]
 43risk_score = 47
 44rule_id = "801ace97-934f-49f8-82c6-c2ac6caf7f60"
 45severity = "medium"
 46tags = [
 47    "Domain: Endpoint",
 48    "Platform: Windows",
 49    "OS: Windows",
 50    "Use Case: Threat Detection",
 51    "Tactic: Defense Evasion",
 52    "Rule Type: Event Correlation (EQL)",
 53    "Data Source: Elastic Defend",
 54    "Data Source: Sysmon",
 55    "Resources: Investigation Guide",
 56]
 57timestamp_override = "event.ingested"
 58type = "eql"
 59
 60query = '''
 61any where host.os.type == "windows" and
 62(
 63  (
 64    event.category == "process" and event.type == "start" and
 65    (process.name : ("HideUL.exe", "HideUL_x64.exe") or ?process.pe.original_file_name : "HideUL.exe")
 66  ) or
 67  (
 68    event.category == "registry" and event.type == "change" and
 69    registry.value : "SystemComponent" and
 70    registry.path : (
 71      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*",
 72      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*"
 73    ) and
 74    registry.data.strings : ("1", "0x00000001") and
 75    not registry.path : "*Microsoft EdgeWebView\\SystemComponent" and
 76    not (
 77      registry.path : "*\\{*}\\SystemComponent" and
 78      process.executable : ("?:\\Windows\\System32\\msiexec.exe") and
 79      user.id : "S-1-5-18"
 80    )
 81  )
 82)
 83'''
 84
 85setup = """
 86## Setup
 87
 88This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 89
 90Setup instructions: https://ela.st/install-elastic-defend
 91
 92### Additional data sources
 93
 94This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 95
 96- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 97- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
 98"""
 99
100note = """## Triage and analysis
101
102### Investigating Potential Uninstall Entry Concealment
103
104#### Possible investigation steps
105
106- Which detection path generated the alert?
107  - Focus: review `event.category`, `process.pe.original_file_name`, `registry.path`, `registry.value`, and `registry.data.strings`.
108  - Implication: a process event identifies HideUL execution but does not prove that an application was hidden. A registry event setting `SystemComponent` to `1` establishes the concealment change but does not by itself identify the utility.
109
110- Which application was targeted, or did the HideUL execution progress to a concealment write?
111  - Focus: for a registry alert, resolve the uninstall subkey's `DisplayName`, `Publisher`, `DisplayVersion`, and `UninstallString` from endpoint state, software inventory, or adjacent events. For a process alert, review same-process events for a `SystemComponent` write. $investigate_0
112  - Implication: hiding remote-access, security, monitoring, or unfamiliar software raises concern. A process-only alert without a corresponding write remains an execution signal; absent registry telemetry is unresolved, not evidence that no application was hidden.
113
114- What binary and launch chain initiated the execution or registry change?
115  - Focus: review `process.executable`, `process.command_line`, `process.hash.sha256`, `process.parent.executable`, and `user.name`; use the process entity or ancestry to recover missing launch context.
116  - Implication: a renamed binary, user-writable path, unexpected parent, remote-management launcher, or unfamiliar hash raises concern. A stable internal path or known hash identifies the binary but does not by itself establish a recognized administrative workflow.
117
118- Did the same process modify other uninstall entries or removal controls?
119  - Focus: review registry events for the alert's `host.id` and `process.entity_id`, including `registry.path`, `registry.value`, `registry.data.strings`, and `event.action`.
120  - Implication: multiple hidden applications, deletion of uninstall entries, or writes to `NoRemove` or `NoModify` increase scope. `HFULOption` is context about HideUL bookkeeping and is not evidence of concealment by itself.
121
122- Does the target or launch context connect this operation to an active remote-access session or broader defense evasion?
123  - Focus: use the same-host related-alert view to find remote-access installation, interactive-session, or defense-evasion alerts. Separately correlate available RMM audit or session records by host, user, and time. $investigate_1
124  - Implication: an active remote session, recent remote-access installation, or another defense-evasion alert increases priority. Missing product or session telemetry is unresolved, not benign.
125
126- If local evidence remains suspicious, is the same utility hash, writer, or hidden product present on other hosts?
127  - Focus: search for the recovered `process.hash.sha256`, writer executable, and target uninstall subkey or resolved product identity across endpoints, keeping the initial time range close to the alert before broadening.
128  - Implication: repeated execution or concealment on additional hosts raises concern for coordinated activity. Recurrence limited to a recognized software-management or hardening pattern on expected hosts lowers concern but is not clearance by itself.
129
130- Escalate when the matched signal, target application, writer, or surrounding activity indicates concealment of remote-access, security, or unfamiliar software, or other high-risk context. Close only when the exact execution or registry change matches a named change record; otherwise preserve the evidence and keep the case unresolved.
131
132### False positive analysis
133
134- Application installation, update, packaging, shared-device, kiosk, lab, or administrative hardening workflows may intentionally set `SystemComponent`. Confirm the matched branch, exact uninstall target when present, binary hash and path, initiating identity, parent process, host group, and change window against the workflow record.
135
136### Response and remediation
137
138- If confirmed benign, document the matched signal, target application when present, and execution context, and reverse any temporary containment.
139- If suspicious but unconfirmed, preserve the alert source event, HideUL or writer binary and hash, launch lineage, target uninstall subkey and sibling values when present, and related remote-session evidence. Restrict the suspected session first; isolate the host only when the evidence and asset role justify it.
140- If confirmed malicious, isolate the host when operationally safe, disable the unauthorized remote-access channel, and contain the associated account or session. Terminate the recovered process only after preserving its entity ID, command line, hash, and available registry evidence.
141- Restore the affected uninstall registration through the owning product's supported installer or a verified pre-change value. Do not delete the application or registry key before preserving evidence and confirming whether the hidden software itself is authorized.
142- Hunt for the same HideUL or writer hash, launch lineage, uninstall subkey, and hidden product on other hosts. Remove confirmed malicious tooling and persistence only after scope is established, then retain process and registry telemetry needed to detect recurrence.
143"""
144
145[rule.investigation_fields]
146field_names = [
147    "@timestamp",
148    "event.category",
149    "host.name",
150    "user.name",
151    "process.executable",
152    "process.command_line",
153    "process.parent.executable",
154    "process.hash.sha256",
155    "process.pe.original_file_name",
156    "registry.path",
157    "registry.value",
158    "registry.data.strings",
159]
160
161[transform]
162[[transform.investigate]]
163label = "Events for the same process"
164description = ""
165providers = [
166  [
167    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
168    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
169  ]
170]
171relativeFrom = "now-1h"
172relativeTo = "now"
173
174[[transform.investigate]]
175label = "Alerts associated with the host"
176description = ""
177providers = [
178  [
179    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
180    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
181  ]
182]
183relativeFrom = "now-48h/h"
184relativeTo = "now"
185
186[[rule.threat]]
187framework = "MITRE ATT&CK"
188
189[[rule.threat.technique]]
190id = "T1564"
191name = "Hide Artifacts"
192reference = "https://attack.mitre.org/techniques/T1564/"
193
194[[rule.threat.technique]]
195id = "T1112"
196name = "Modify Registry"
197reference = "https://attack.mitre.org/techniques/T1112/"
198
199[rule.threat.tactic]
200id = "TA0005"
201name = "Defense Evasion"
202reference = "https://attack.mitre.org/tactics/TA0005/"