registry_event

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Sep 2, 2024 · attack.defense-evasion attack.t1562.001 ·

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Atbroker Registry Change

Aug 12, 2024 · attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·

Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

CMSTP Execution Registry Event

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1218.003 attack.g0069 car.2019-04-001 ·

Share on:

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Creation of a Local Hidden User Account by Registry

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Sysmon registry detection of a local hidden user account.

Disable Security Events Logging Adding Reg Key MiniNt

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.

DLL Load via LSASS

Aug 12, 2024 · attack.execution attack.persistence attack.t1547.008 ·

Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Esentutl Volume Shadow Copy Service Keys

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

HybridConnectionManager Service Installation - Registry

Aug 12, 2024 · attack.resource-development attack.t1608 ·

Share on:

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

Narrator's Feedback-Hub Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

NetNTLM Downgrade Attack - Registry

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

New DLL Added to AppCertDlls Registry Key

Aug 12, 2024 · attack.persistence attack.t1546.009 ·

Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

New DLL Added to AppInit_DLLs Registry Key

Aug 12, 2024 · attack.persistence attack.t1546.010 ·

Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

New PortProxy Registry Entry Added

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.command-and-control attack.t1090 ·

Share on:

Detects the modification of the PortProxy registry key which is used for port forwarding.

Office Application Startup - Office Test

Aug 12, 2024 · attack.persistence attack.t1137.002 ·

Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Pandemic Registry Key

Aug 12, 2024 · attack.command-and-control attack.t1105 ·

Share on:

Detects Pandemic Windows Implant

Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·

Share on:

Detects value modification of registry key containing path to binary used as screensaver.

Potential Credential Dumping Via LSASS SilentProcessExit Technique

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

Potential Qakbot Registry Activity

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

PrinterNightmare Mimikatz Driver Name

Aug 12, 2024 · attack.execution attack.t1204 cve.2021-1675 cve.2021-34527 ·

Share on:

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

RedMimicry Winnti Playbook Registry Manipulation

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook

Registry Entries For Azorult Malware

Aug 12, 2024 · attack.execution attack.t1112 ·

Share on:

Detects the presence of a registry key created during Azorult execution

Registry Persistence Mechanisms in Recycle Bin

Aug 12, 2024 · attack.persistence attack.t1547 ·

Share on:

Detects persistence registry keys for Recycle Bin

Run Once Task Configuration in Registry

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

Security Support Provider (SSP) Added to LSA Configuration

Aug 12, 2024 · attack.persistence attack.t1547.005 ·

Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Shell Open Registry Keys Manipulation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·

Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·

Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Suspicious Camera and Microphone Access

Aug 12, 2024 · attack.collection attack.t1125 attack.t1123 ·

Share on:

Detects Processes accessing the camera and microphone from suspicious folder

Suspicious Run Key from Download

Aug 12, 2024 · attack.persistence attack.t1547.001 ·

Share on:

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

UAC Bypass Via Wsreset

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Wdigest CredGuard Registry Modification

Aug 12, 2024 · attack.defense-evasion attack.t1112 ·

Share on:

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

Windows Credential Editor Registry

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·

Share on:

Detects the use of Windows Credential Editor (WCE)

Windows Registry Trust Record Modification

Aug 12, 2024 · attack.initial-access attack.t1566.001 ·

Share on:

Alerts on trust record modification within the registry, indicating usage of macros

WINEKEY Registry Modification

Aug 12, 2024 · attack.persistence attack.t1547 ·

Share on:

Detects potential malicious modification of run keys by winekey or team9 backdoor