Suspicious Path In Keyboard Layout IME File Registry Value

 1title: Suspicious Path In Keyboard Layout IME File Registry Value
 2id: 9d8f9bb8-01af-4e15-a3a2-349071530530
 3related:
 4    - id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1
 5      type: derived
 6status: experimental
 7description: |
 8    Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
 9    Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
10    IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.    
11references:
12    - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
13author: X__Junior (Nextron Systems)
14date: 2023/11/21
15tags:
16    - attack.defense_evasion
17    - attack.t1562.001
18logsource:
19    product: windows
20    category: registry_set
21detection:
22    selection_registry:
23        TargetObject|contains|all:
24            - '\Control\Keyboard Layouts\'
25            - 'Ime File'
26    selection_folders_1:
27        Details|contains:
28            - ':\Perflogs\'
29            - ':\Users\Public\'
30            - ':\Windows\Temp\'
31            - '\AppData\Local\Temp\'
32            - '\AppData\Roaming\'
33            - '\Temporary Internet'
34    selection_folders_2:
35        - Details|contains|all:
36              - ':\Users\'
37              - '\Favorites\'
38        - Details|contains|all:
39              - ':\Users\'
40              - '\Favourites\'
41        - Details|contains|all:
42              - ':\Users\'
43              - '\Contacts\'
44    condition: selection_registry and 1 of selection_folders_*
45falsepositives:
46    - Unknown
47level: high