Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

calendar Aug 17, 2023 · attack.defense_evasion attack.t1218  ·
Share on: linkedin copy

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Sigma rule (View on GitHub)

 1title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
 2id: 7021255e-5db3-4946-a8b9-0ba7a4644a69
 3related:
 4    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
 5      type: similar
 6    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
 7      type: similar
 8    - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 # CLI Registry
 9      type: similar
10status: experimental
11description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
12references:
13    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
14    - https://twitter.com/0gtweet/status/1674399582162153472
15author: Swachchhanda Shrawan Poudel
16date: 2023/08/02
17modified: 2023/08/17
18tags:
19    - attack.defense_evasion
20    - attack.t1218
21logsource:
22    category: registry_set
23    product: windows
24    definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored'
25detection:
26    selection:
27        TargetObject|contains: '\SOFTWARE\Microsoft\Provisioning\Commands\'
28    condition: selection
29falsepositives:
30    - Unknown
31level: high

References

  • Provlaunch | LOLBAS

    Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. "reg.exe add HKLM\SOFTWARE\Micros...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top