Potential Provisioning Registry Key Abuse For Binary Proxy Execution

calendar Aug 9, 2023 · attack.defense_evasion attack.t1218  ·
Share on: linkedin copy

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Sigma rule (View on GitHub)

 1title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution
 2id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25
 3related:
 4    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
 5      type: similar
 6    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
 7      type: similar
 8    - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 # Registry
 9      type: similar
10status: experimental
11description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
12references:
13    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
14    - https://twitter.com/0gtweet/status/1674399582162153472
15author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
16date: 2023/08/08
17tags:
18    - attack.defense_evasion
19    - attack.t1218
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        CommandLine|contains: 'SOFTWARE\Microsoft\Provisioning\Commands\'
26    condition: selection
27falsepositives:
28    - Unknown
29level: high

References

  • Provlaunch | LOLBAS

    Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. "reg.exe add HKLM\SOFTWARE\Micros...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top