registry_add

PUA - Sysinternals Tools Execution - Registry

Oct 28, 2023 · attack.resource_development attack.t1588.002 ·

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Potential Persistence Via Logon Scripts - Registry

Jun 9, 2023 · attack.t1037.001 attack.persistence attack.lateral_movement ·

Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Potential Persistence Via New AMSI Providers - Registry

Feb 20, 2023 · attack.persistence ·

Share on:

Detects when an attacker registers a new AMSI provider in order to achieve persistence

Potential NetWire RAT Activity - Registry

Feb 9, 2023 · attack.defense_evasion attack.t1112 ·

Share on:

Detects registry keys related to NetWire RAT

Potential Ursnif Malware Activity - Registry

Feb 9, 2023 · attack.execution attack.t1112 ·

Share on:

Detects registry keys related to Ursnif malware.

Suspicious Execution Of Renamed Sysinternals Tools - Registry

Feb 9, 2023 · attack.resource_development attack.t1588.002 ·

Share on:

Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Potential COM Object Hijacking Via TreatAs Subkey - Registry

Feb 7, 2023 · attack.persistence attack.t1546.015 ·

Share on:

Detects COM object hijacking via TreatAs subkey

Potential Persistence Via Disk Cleanup Handler - Registry

Feb 7, 2023 · attack.persistence ·

Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

PUA - Sysinternal Tool Execution - Registry

Feb 7, 2023 · attack.resource_development attack.t1588.002 ·

Share on:

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key