Enable WDigest using PowerShell (ps_module)

 1title: Enable WDigest using PowerShell (ps_module)
 2id: c677394a-1e3e-4ab5-a6a8-295bf0b71137
 3description: Rule to detect registry modifications to enable WDigest using powershell script modules.
 4status: experimental
 5date: 2022/06/05
 6author: The DFIR Report
 7references:
 8    - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
 9tags:
10    - attack.defense_evasion
11    - attack.t1112
12logsource:
13    product: windows
14    category: ps_module
15    definition: PowerShell Module Logging must be enabled
16detection:
17    selection_4103:
18        Payload|contains|all: 
19          - 'Set-ItemProperty'
20          - 'UseLogonCredential'
21          - 'WDigest'
22          - 'Value'
23          - '1'
24    condition: selection_4103
25falsepositives:
26    - Admin activity
27level: medium

References

• Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration

  

  In this multi-day intrusion, we observed a threat actor gain initial access to an organization by exploiting a vulnerability in ManageEngine SupportCenter Plus. The threat actor, discovered files o…

  
  Read More

Related rules

• Bumblebee WmiPrvSE execution pattern
• ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)
• Web Browser Creates Zip Archive File (Sysmon)
• Suspicious Use of Rcedit Utility to Alter Executable Metadata
• Command or Scripting Interpreter Creating EXE File