Potential RemoteMonologue Attack

  1[metadata]
  2creation_date = "2025/04/14"
  3integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempt to perform session hijack via COM object registry modification by setting the RunAs value to
 11Interactive User.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.registry-*",
 16    "endgame-*",
 17    "logs-m365_defender.event-*",
 18    "logs-sentinel_one_cloud_funnel.*",
 19    "logs-windows.sysmon_operational-*",
 20]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Potential RemoteMonologue Attack"
 24note = """## Triage and analysis
 25
 26### Investigating Potential RemoteMonologue Attack
 27
 28
 29### Possible investigation steps
 30
 31- Review the registry event logs to confirm the modification of the RunAs value in the specified registry paths, ensuring the change was not part of a legitimate administrative action.
 32- Identify the user account and process responsible for the registry modification by examining the event logs for associated user and process information.
 33- Check for any recent remote authentication attempts or sessions on the affected host to determine if this activity is associated with lateral movement or not.
 34- Investigate the timeline of the registry change to correlate with any other suspicious activities or alerts on the host, such as the execution of unusual processes or network connections.
 35
 36### False positive analysis
 37
 38- Software updates or installations that modify COM settings.
 39- Automated scripts or management tools that adjust COM configurations.
 40
 41### Response and remediation
 42
 43- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
 44- Modify the registry value back to its secure state, ensuring that "RunAs" value is not set to "Interactive User".
 45- Conduct a thorough review of recent user activity and system logs to identify any unauthorized access or changes made during the period NLA was disabled.
 46- Reset passwords for all accounts that have accessed the affected system to mitigate potential credential compromise.
 47- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
 48- Implement enhanced monitoring on the affected system and similar endpoints to detect any further attempts to disable NLA or other suspicious activities.
 49"""
 50
 51setup = """## Setup
 52
 53This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 54
 55Setup instructions: https://ela.st/install-elastic-defend
 56
 57### Additional data sources
 58
 59This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 60
 61- [Microsoft Defender XDR](https://ela.st/m365-defender)
 62- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 63- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
 64"""
 65
 66references = [
 67    "https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions#1",
 68    "https://github.com/xforcered/RemoteMonologue",
 69]
 70risk_score = 47
 71rule_id = "c18975f5-676c-4091-b626-81e8938aa2ee"
 72severity = "medium"
 73tags = [
 74    "Domain: Endpoint",
 75    "OS: Windows",
 76    "Use Case: Threat Detection",
 77    "Tactic: Defense Evasion",
 78    "Data Source: Elastic Defend",
 79    "Data Source: Elastic Endgame",
 80    "Data Source: Microsoft Defender XDR",
 81    "Data Source: SentinelOne",
 82    "Data Source: Sysmon",
 83    "Resources: Investigation Guide",
 84    "Noise: Medium",
 85    "Performance: Normal",
 86    "Rule Type: Event Correlation (EQL)",
 87    "Platform: Windows",
 88]
 89timestamp_override = "event.ingested"
 90type = "eql"
 91
 92query = '''
 93registry where host.os.type == "windows" and event.action != "deletion" and
 94  registry.value == "RunAs" and registry.data.strings : "Interactive User" and
 95
 96  not 
 97  (
 98    (
 99      process.executable : (
100        "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.*\\MsMpEng.exe",
101        "C:\\Program Files\\Windows Defender\\MsMpEng.exe"
102      ) and
103      registry.path : "*\\SOFTWARE\\Classes\\AppID\\{1111A26D-EF95-4A45-9F55-21E52ADF9887}\\RunAs"
104    ) or
105    (
106      process.executable : (
107        "C:\\Program Files\\TeamViewer\\TeamViewer.exe",
108        "C:\\Program Files (x86)\\TeamViewer\\TeamViewer.exe"
109      ) and
110      registry.path : "*\\SOFTWARE\\Classes\\AppID\\{850A928D-5456-4865-BBE5-42635F1EBCA1}\\RunAs"
111    ) or
112    (
113      process.executable : "C:\\Windows\\System32\\svchost.exe" and
114      registry.path : "*\\S-1-*Classes\\AppID\\{D3E34B21-9D75-101A-8C3D-00AA001A1652}\\RunAs"
115    ) or
116    (
117      process.executable : "C:\\Windows\\System32\\SecurityHealthService.exe" and
118      registry.path : (
119        "*\\SOFTWARE\\Classes\\AppID\\{1D278EEF-5C38-4F2A-8C7D-D5C13B662567}\\RunAs",
120        "*\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9878}\\RunAs"
121      )
122    ) or
123    (
124      process.executable : "C:\\Windows\\System32\\SecurityHealthService.exe" and
125      registry.path : (
126        "*\\SOFTWARE\\Classes\\AppID\\{1D278EEF-5C38-4F2A-8C7D-D5C13B662567}\\RunAs",
127        "*\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9878}\\RunAs"
128      )
129    ) or
130    registry.path : (
131      "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_*",
132      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_*"
133    ) or
134    (process.executable : "C:\\windows\\System32\\msiexec.exe" and ?user.id : "S-1-5-18")
135  )
136'''
137
138
139[[rule.threat]]
140framework = "MITRE ATT&CK"
141
142[[rule.threat.technique]]
143id = "T1112"
144name = "Modify Registry"
145reference = "https://attack.mitre.org/techniques/T1112/"
146
147[[rule.threat.technique]]
148id = "T1562"
149name = "Impair Defenses"
150reference = "https://attack.mitre.org/techniques/T1562/"
151
152[rule.threat.tactic]
153id = "TA0005"
154name = "Defense Evasion"
155reference = "https://attack.mitre.org/tactics/TA0005/"
156
157[[rule.threat]]
158framework = "MITRE ATT&CK"
159
160[[rule.threat.technique]]
161id = "T1546"
162name = "Event Triggered Execution"
163reference = "https://attack.mitre.org/techniques/T1546/"
164
165[[rule.threat.technique.subtechnique]]
166id = "T1546.015"
167name = "Component Object Model Hijacking"
168reference = "https://attack.mitre.org/techniques/T1546/015/"
169
170[rule.threat.tactic]
171id = "TA0003"
172name = "Persistence"
173reference = "https://attack.mitre.org/tactics/TA0003/"