Impacket AtExec Suspicious Registry Modification
Detects Atexec.py (Impacket) suspicious registry key addition.
Sigma rule (View on GitHub)
1title: Impacket AtExec Suspicious Registry Modification
2id: be577827-db17-4786-b00a-347c93973662
3status: experimental
4description: Detects Atexec.py (Impacket) suspicious registry key addition.
5references:
6 - https://www.13cubed.com/downloads/impacket_exec_commands_cheat_sheet.pdf
7 - https://www.hackingarticles.in/impacket-guide-smb-msrpc/
8 - https://u0041.co/blog/post/1
9author: Micah Babinski
10date: 2023/01/08
11tags:
12 - attack.s0357
13 - attack.execution
14 - attack.t1053
15 - attack.t1053.002
16logsource:
17 product: windows
18 category: registry_add
19detection:
20 selection:
21 EventType: 'CreateKey'
22 Image|endswith: '\svchost.exe'
23 TargetObject|re: '^HKLM\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\[A-Za-z]{8}$'
24 condition: selection
25falsepositives:
26 - Unknown
27level: medium```
References
-
There have been many Red Team scenarios, Capture the Flag challenges where we face the Windows Server. After exploiting and getting the initial foothold in
Read More
Related rules
- Impacket AtExec Suspicious Temp File Creation
- Possible Impacket AtExec Activity
- Windows Scheduled Task Behaving Improperly or Suspiciously
- Windows Scheduled Task Create Shell
- Windows Scheduled Task Making Suspicious Network Connection