registry_set | Detection.FYI

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Sep 7, 2023 · attack.defense_evasion ·
Share on:

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

Read More
Old TLS1.0/TLS1.1 Protocol Version Enabled

Sep 7, 2023 · attack.defense_evasion ·
Share on:

Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.

Read More
Potential Persistence Via Visual Studio Tools for Office

Aug 28, 2023 · attack.t1137.006 attack.persistence ·
Share on:

Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Read More
New BgInfo.EXE Custom DB Path Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Read More
New BgInfo.EXE Custom VBScript Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

Read More
New BgInfo.EXE Custom WMI Query Registry Configuration

Aug 18, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Read More
Suspicious Service Installed

Aug 17, 2023 · attack.t1562.001 attack.defense_evasion ·
Share on:

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Read More
Activate Suppression of Windows Security Center Notifications

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect set Notification_Suppress to 1 to disable the Windows security center notification

Read More
Add Debugger Entry To AeDebug For Persistence

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add Debugger Entry To Hangs Key For Persistence

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Read More
Add DisallowRun Execution to Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect set DisallowRun to 1 to prevent user running specific computer program

Read More
Add Port Monitor Persistence in Registry

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Adwind RAT / JRAT - Registry

Aug 17, 2023 · attack.execution attack.t1059.005 attack.t1059.007 ·
Share on:

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Read More
Allow RDP Remote Assistance Feature

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Read More
Blackbyte Ransomware Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption

Read More
Blue Mockingbird - Registry

Aug 17, 2023 · attack.execution attack.t1112 attack.t1047 ·
Share on:

Attempts to detect system changes made by Blue Mockingbird

Read More
Bypass UAC Using DelegateExecute

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using Event Viewer

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Bypass UAC Using SilentCleanup Task

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·
Share on:

There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC

Read More
Change Winevt Event Access Permission Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·
Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel

Read More
Changing RDP Port to Non Standard Number

Aug 17, 2023 · attack.persistence attack.t1547.010 ·
Share on:

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Classes Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
ClickOnce Trust Prompt Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Read More
CobaltStrike Service Installations in Registry

Aug 17, 2023 · attack.execution attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml) In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services or HKLM\System\ControlSet002\Services, however, this rule is based on a regular sysmon's events.

Read More
COM Hijack via Sdclt

Aug 17, 2023 · attack.privilege_escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
COM Hijacking via TreatAs

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
Common Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CrashControl CrashDump Disabled

Aug 17, 2023 · attack.t1564 attack.t1112 ·
Share on:

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Read More
CurrentControlSet Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Custom File Open Handler Executes PowerShell

Aug 17, 2023 · attack.defense_evasion attack.t1202 ·
Share on:

Detects the abuse of custom file open handler, executing powershell

Read More
DHCP Callout DLL Installation

Aug 17, 2023 · attack.defense_evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
Disable Administrative Share Creation at Startup

Aug 17, 2023 · attack.defense_evasion attack.t1070.005 ·
Share on:

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Read More
Disable Exploit Guard Network Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Read More
Disable Internal Tools or Feature in Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Read More
Disable Macro Runtime Scan Scope

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros

Read More
Disable Microsoft Defender Firewall via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.004 ·
Share on:

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Read More
Disable Privacy Settings Experience in Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects registry modifications that disable Privacy Settings Experience

Read More
Disable PUA Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender PUA protection

Read More
Disable Sysmon Event Logging Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects changes in Sysmon driver altitude. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Read More
Disable Tamper Protection on Windows Defender

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects disabling Windows Defender Tamper Protection

Read More
Disable UAC Using Registry

Aug 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) by changing its registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0

Read More
Disable Windows Defender Functionalities Via Registry Keys

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Read More
Disable Windows Event Logging Via Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·
Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Read More
Disable Windows Firewall by Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.004 ·
Share on:

Detect set EnableFirewall to 0 to disable the Windows firewall

Read More
Disable Windows Security Center Notifications

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Read More
Disabled RestrictedAdminMode For RDS

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect activation of DisableRestrictedAdmin to desable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

Read More
Disabled Windows Defender Eventlog

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Read More
DNS-over-HTTPS Enabled by Registry

Aug 17, 2023 · attack.defense_evasion attack.t1140 attack.t1112 ·
Share on:

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Read More
Enable Local Manifest Installation With Winget

Aug 17, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Read More
Enable Microsoft Dynamic Data Exchange

Aug 17, 2023 · attack.execution attack.t1559.002 ·
Share on:

Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Read More
Enabling COR Profiler Environment Variables

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.012 ·
Share on:

This rule detects cor_enable_profiling and cor_profiler environment variables being set and configured.

Read More
ETW Logging Disabled For rpcrt4.dll

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Read More
ETW Logging Disabled For SCM

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·
Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Read More
ETW Logging Disabled In .NET Processes - Sysmon Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 attack.t1562 ·
Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Read More
Execution DLL of Choice Using WAB.EXE

Aug 17, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Read More
Hide Schedule Task Via Index Value Tamper

Aug 17, 2023 · attack.defense_evasion attack.t1562 ·
Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Read More
IE Change Domain Zone

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Internet Explorer Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Internet Explorer DisableFirstRunCustomize Enabled

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

Read More
Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Aug 17, 2023 · attack.command_and_control attack.t1105 ·
Share on:

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

Read More
Lsass Full Dump Request Via DumpType Registry Settings

Aug 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Read More
Macro Enabled In A Potentially Suspicious Document

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry changes to Office trust records where the path is located in a potentially suspicious location

Read More
Microsoft Office Protected View Disabled

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

Read More
Modification of Explorer Hidden Keys

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·
Share on:

Detects modifications to the hidden files keys in registry. This technique is abused by several malware families to hide their files from normal users.

Read More
Modification of IE Registry Settings

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence

Read More
Modify User Shell Folders Startup Value

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
NET NGenAssemblyUsageLog Registry Key Tamper

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.

Read More
New Application in AppCompat

Aug 17, 2023 · attack.execution attack.t1204.002 ·
Share on:

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Read More
New DNS ServerLevelPluginDll Installed

Aug 17, 2023 · attack.defense_evasion attack.t1574.002 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New File Association Using Exefile

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

Read More
New ODBC Driver Registered

Aug 17, 2023 · attack.persistence ·
Share on:

Detects the registration of a new ODBC driver.

Read More
New Root or CA or AuthRoot Certificate to Store

Aug 17, 2023 · attack.impact attack.t1490 ·
Share on:

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Read More
New RUN Key Pointing to Suspicious Folder

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
Office Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Office Macros Auto-Enabled

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Read More
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Read More
Outlook Macro Execution Without Warning Setting Enabled

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Outlook Security Settings Updated - Registry

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Detects changes to the registry values related to outlook security settings

Read More
Persistence Via Disk Cleanup Handler - Autorun

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.

Read More
Persistence Via Hhctrl.ocx

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Read More
Persistence Via New SIP Provider

Aug 17, 2023 · attack.persistence attack.defense_evasion attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential AMSI COM Server Hijacking

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

Read More
Potential Attachment Manager Settings Associations Tamper

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)

Read More
Potential Attachment Manager Settings Attachments Tamper

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects tampering with attachment manager settings policies attachments (See reference for more information)

Read More
Potential AutoLogger Sessions Tampering

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - REG

Aug 17, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential EventLog File Location Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1562.002 ·
Share on:

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

Read More
Potential Persistence Using DebugPath

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via App Paths Default Property

Aug 17, 2023 · attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to pre-pend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via AutodialDLL

Aug 17, 2023 · attack.persistence ·
Share on:

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Read More
Potential Persistence Via CHM Helper DLL

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Read More
Potential Persistence Via COM Hijacking From Suspicious Locations

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a supsicious or unsuale location

Read More
Potential Persistence Via COM Search Order Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking leveraging the COM Search Order

Read More
Potential Persistence Via DLLPathOverride

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Read More
Potential Persistence Via Excel Add-in - Registry

Aug 17, 2023 · attack.persistence attack.t1137.006 ·
Share on:

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Read More
Potential Persistence Via LSA Extensions

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

Read More
Potential Persistence Via Mpnotify

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More
Potential Persistence Via MyComputer Registry Keys

Aug 17, 2023 · attack.persistence ·
Share on:

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Read More
Potential Persistence Via Outlook Home Page

Aug 17, 2023 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook home pages.

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Aug 17, 2023 · attack.persistence attack.command_and_control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via Outlook Today Pages

Aug 17, 2023 · attack.persistence attack.t1112 ·
Share on:

Detects potential persistence activity via outlook today pages. An attacker can set a custom page to execute arbitrary code and link to it via the registry key "UserDefinedUrl".

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Shim Database In Uncommon Location

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Persistence Via Shim Database Modification

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential Persistence Via TypedPaths

Aug 17, 2023 · attack.persistence ·
Share on:

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Read More
Potential PowerShell Execution Policy Tampering

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Read More
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

Aug 17, 2023 · attack.defense_evasion attack.t1218 ·
Share on:

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Read More
Potential PSFactoryBuffer COM Hijacking

Aug 17, 2023 · attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Ransomware Activity Using LegalNotice Message

Aug 17, 2023 · attack.impact attack.t1491.001 ·
Share on:

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Aug 17, 2023 · attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Aug 17, 2023 · attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potential Signing Bypass Via Windows Developer Features - Registry

Aug 17, 2023 · attack.defense_evasion ·
Share on:

Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Read More
Potentially Suspicious ODBC Driver Registered

Aug 17, 2023 · attack.persistence attack.t1003 ·
Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Read More
PowerShell as a Service in Registry

Aug 17, 2023 · attack.execution attack.t1569.002 ·
Share on:

Detects that a powershell code is written to the registry as a service.

Read More
PowerShell Logging Disabled Via Registry Key Tampering

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·
Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Read More
RDP Sensitive Settings Changed

Aug 17, 2023 · attack.defense_evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc

Read More
Register New IFiltre For Persistence

Aug 17, 2023 · attack.persistence ·
Share on:

Detects when an attacker register a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files

Read More
Registry Disable System Restore

Aug 17, 2023 · attack.impact attack.t1490 ·
Share on:

Detects the modification of the registry to disable a system restore on the computer

Read More
Registry Explorer Policy Modification

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Read More
Registry Hide Function from User

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Read More
Registry Modification to Hidden File Extension

Aug 17, 2023 · attack.persistence attack.t1137 ·
Share on:

Hides the file extension through modification of the registry

Read More
Registry Persistence via Explorer Run Key

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Registry Persitence via Service in Safe Mode

Aug 17, 2023 · attack.defense_evasion attack.t1564.001 ·
Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Read More
Running Chrome VPN Extensions via the Registry 2 VPN Extension

Aug 17, 2023 · attack.persistence attack.t1133 ·
Share on:

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Read More
Scheduled TaskCache Change by Uncommon Program

Aug 17, 2023 · attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
ScreenSaver Registry Key Set

Aug 17, 2023 · attack.defense_evasion attack.t1218.011 ·
Share on:

Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl

Read More
Scripted Diagnostics Turn Off Check Enabled - Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability

Read More
Service Binary in Suspicious Folder

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect the creation of a service with a service binary located in a suspicious directory

Read More
Service Binary in Uncommon Folder

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detect the creation of a service with a service binary located in a uncommon directory

Read More
ServiceDll Hijack

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
Session Manager Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Set TimeProviders DllName

Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
Suspicious Application Allowed Through Exploit Guard

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings

Read More
Suspicious Environment Variable Has Been Registered

Aug 17, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings

Read More
Suspicious Keyboard Layout Load

Aug 17, 2023 · attack.resource_development attack.t1588.002 ·
Share on:

Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only

Read More
Suspicious New Printer Ports in Registry (CVE-2020-1048)

Aug 17, 2023 · attack.persistence attack.execution attack.defense_evasion attack.t1112 ·
Share on:

Detects a new and suspicious printer port creation in Registry that could be an attempt to exploit CVE-2020-1048

Read More
Suspicious Powershell In Registry Run Keys

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious Printer Driver Empty Manufacturer

Aug 17, 2023 · attack.privilege_escalation attack.t1574 cve.2021.1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Aug 17, 2023 · attack.defense_evasion attack.t1221 ·
Share on:

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Read More
Suspicious Shim Database Patching Activity

Aug 17, 2023 · attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
System Scripts Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Tamper With Sophos AV Registry Keys

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects tamper attempts to sophos av functionality via registry key modification

Read More
Trust Access Disable For VBApplications

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Read More
UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Using Windows Media Player - Registry

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass via Sdclt

Aug 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

Read More
Uncommon Microsoft Office Trusted Location Added

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Read More
Usage of Renamed Sysinternals Tools - RegistrySet

Aug 17, 2023 · attack.resource_development attack.t1588.002 ·
Share on:

Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Read More
VBScript Payload Stored in Registry

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Wdigest Enable UseLogonCredential

Aug 17, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Read More
Windows Defender Exclusions Added - Registry

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects the Setting of Windows Defender Exclusions

Read More
Windows Defender Service Disabled

Aug 17, 2023 · attack.defense_evasion attack.t1562.001 ·
Share on:

Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry

Read More
Winget Admin Settings Modification

Aug 17, 2023 · attack.defense_evasion attack.persistence ·
Share on:

Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

Read More
Winlogon AllowMultipleTSSessions Enable

Aug 17, 2023 · attack.persistence attack.defense_evasion attack.t1112 ·
Share on:

Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users

Read More
Winlogon Notify Key Logon Persistence

Aug 17, 2023 · attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
WinSock2 Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Classes Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Aug 17, 2023 · attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Potential WerFault ReflectDebugger Registry Value Abuse

Jul 24, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.

Read More
Potential Persistence Via GlobalFlags

Jun 5, 2023 · attack.privilege_escalation attack.persistence attack.defense_evasion attack.t1546.012 car.2013-01-002 ·
Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Read More
Potential Persistence Via Custom Protocol Handler

May 15, 2023 · attack.defense_evasion attack.t1112 ·
Share on:

Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

Read More
Potential Persistence Via Event Viewer Events.asp

Mar 10, 2023 · attack.persistence attack.defense_evasion attack.t1112 ·
Share on:

Detects potential registry persistence technique using the Event Viewer "Events.asp" technique

Read More
RDP Sensitive Settings Changed to Zero

Feb 7, 2023 · attack.defense_evasion attack.persistence attack.t1112 ·
Share on:

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Read More
Hiding User Account Via SpecialAccounts Registry Key

Feb 1, 2023 · attack.defense_evasion attack.t1564.002 ·
Share on:

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Read More
UAC Bypass via Event Viewer - Registry Set

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects UAC bypass method using Windows event viewer

Read More
Potential PendingFileRenameOperations Tamper

Jan 27, 2023 · attack.defense_evasion attack.t1036.003 ·
Share on:

Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images lcoations to stage currently used files for rename after reboot.

Read More
Change the Fax Dll

Dec 30, 2022 · attack.defense_evasion attack.t1112 ·
Share on:

Detect possible persistence using Fax DLL load when service restart

Read More
Change User Account Associated with the FAX Service

Dec 30, 2022 · attack.defense_evasion attack.t1112 ·
Share on:

Detect change of the user account associated with the FAX service to avoid the escalation problem.

Read More