alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Sigma rule: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution. Logsource: windows / registry_set. Rule: title: Usage of Renamed Sysinternals Tools - RegistrySet id: 8023f872-3f1d-4301-a384-801889917ab4 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: f50f3c09-557d-492d-81db-9064a8d4e211 type: similar status: test description: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \PsExec - \ProcDump - \Handle - \LiveKd - \Process Explorer - \PsLoglist - \PsPasswd - \Active Directory Explorer TargetObject|endswith: \EulaAccepted filter_main_image_names: Image|endswith: - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Sigma rule: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th. Logsource: windows / registry_set. Rule: title: Potential Signing Bypass Via Windows Developer Features - Registry id: b110ebaf-697f-4da1-afd5-b536fa27a2c1 related: - id: a383dec4-deec-4e6e-913b-ed9249670848 type: similar status: test description: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages. references: - https://twitter.com/malmoeb/status/1560536653709598721 - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\CurrentVersion\AppModelUnlock - \Policies\Microsoft\Windows\Appx\ TargetObject|endswith: - \AllowAllTrustedApps - \AllowDevelopmentWithoutDevLicense Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / registry_set. Rule: title: RestrictedAdminMode Registry Value Tampering id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 related: - id: 28ac00d6-22d9-4a3c-927f-bbd770104573 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx author: frack113 date: 2023-01-13 modified: 2024-08-23 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling. Logsource: azure / auditlogs. Rule: title: Application URI Configuration Changes id: 0055ad1f-be85-4798-83cf-a6da17c993b3 status: test description: 'Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.stealth - attack.t1528 - attack.t1078.004 - attack.persistence - attack.credential-access - attack.privilege-escalation logsource: product: azure service: auditlogs detection: selection: properties.message: Update Application Sucess- Property Name AppAddress condition: selection falsepositives: - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event. level: high
Sigma rule: Detects base64 encoded .NET reflective loading of Assembly. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded Reflective Assembly Load id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59 related: - id: 9c0295ce-d60d-40bd-bd74-84673b7592b1 type: similar status: test description: Detects base64 encoded .NET reflective loading of Assembly references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: Christian Burkard (Nextron Systems), pH-T (Nextron Systems) date: 2022-03-01 modified: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 - attack.t1620 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA - sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA - bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA - AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiAC - BbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgAp - AWwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAK - WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAKQ - sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiACkA - bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgApA - WwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA - sAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA - bAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behin. Logsource: windows / process_creation. Rule: title: Directory Removal Via Rmdir id: 41ca393d-538c-408a-ac27-cf1e038be80c status: test description: 'Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary''s footprint. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 date: 2022-01-15 modified: 2023-03-07 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_rmdir: CommandLine|contains: rmdir selection_flags: CommandLine|contains: - /s - /q condition: all of selection_* falsepositives: - Unknown level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml
Sigma rule: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Execution id: 90d6bd71-dffb-4989-8d86-a827fedd6624 status: test description: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems), citron_ninja date: 2023-10-25 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1071.001 - attack.t1219 logsource: category: process_creation product: windows detection: selection_only_tunnel: OriginalFileName: null CommandLine|endswith: .exe tunnel selection_tunnel_args: CommandLine|contains|all: - .exe tunnel - --accept-server-license-terms selection_parent_tunnel: ParentCommandLine|endswith: ' tunnel' Image|endswith: \cmd.exe CommandLine|contains|all: - '/d /c ' - \servers\Stable- - code-server.cmd condition: 1 of selection_* falsepositives: - Legitimate use of Visual Studio Code tunnel level: medium
Sigma rule: Detects execution of the bash shell with the interactive flag "-i".. Logsource: linux / process_creation. Rule: title: Bash Interactive Shell id: 6104e693-a7d6-4891-86cb-49a258523559 status: test description: Detects execution of the bash shell with the interactive flag "-i". references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://linux.die.net/man/1/bash author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /bash CommandLine|contains: ' -i ' condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities. Logsource: windows / ps_script. Rule: title: Potential AMSI Bypass Script Using NULL Bits id: fa2559c8-1197-471d-9cdd-05a0273d4522 related: - id: 92a974db-ab84-457f-9ec0-55db83d7a825 type: similar status: test description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities references: - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-05-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - if(0){{{0}}}' -f $(0 -as [char]) + - '#<NULL>' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat a. Logsource: windows / dns_query. Rule: title: DNS Query To AzureWebsites.NET By Non-Browser Process id: e043f529-8514-4205-8ab0-7f7d2927b400 related: - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 type: derived status: test description: 'Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: azurewebsites.net filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_optional_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_defender: Image|endswith: - \MsMpEng.exe - \MsSense.exe filter_optional_brave: Image|endswith: \brave.exe Image|startswith: C:\Program Files\BraveSoftware\ filter_optional_maxthon: Image|contains: \AppData\Local\Maxthon\ Image|endswith: \maxthon.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_seamonkey: Image|startswith: - C:\Program Files\SeaMonkey\ - C:\Program Files (x86)\SeaMonkey\ Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|contains: \AppD
Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Email Attachment) id: 571498c8-908e-40b4-910b-d2369159a3da status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.initial-access - attack.stealth - attack.t1027 - attack.t1566.001 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains|all: - Microsoft_Windows_Shell_ZipFolder:filename - \Temporary Internet Files\Content.Outlook condition: selection falsepositives: - Legitimate used of encrypted ZIP files level: high
Sigma rule: Detects execution of Chromium based browser in headless mode. Logsource: windows / process_creation. Rule: title: Browser Execution In Headless Mode id: ef9dcfed-690c-4c5d-a9d1-482cd422225c related: - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e type: derived status: test description: Detects execution of Chromium based browser in headless mode references: - https://twitter.com/mrd0x/status/1478234484881436672?s=12 - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-12 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --headless condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Server Service Abuse for Lateral Movement id: 10018e73-06ec-46ec-8107-9172f1e04ff2 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement - attack.execution - attack.t1569.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 367abb81-9844-35f1-ad32-98f038001003 condition: selection falsepositives: - Administrative tasks on remote services level: high
Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Sigma rule: Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.. Logsource: windows / process_creation. Rule: title: HackTool - RemoteKrbRelay Execution id: a7664b14-75fb-4a50-a223-cb9bc0afbacf status: test description: 'Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata. ' references: - https://github.com/CICADA8-Research/RemoteKrbRelay author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-27 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \RemoteKrbRelay.exe - OriginalFileName: RemoteKrbRelay.exe selection_cli_required: CommandLine|contains|all: - ' -clsid ' - ' -target ' - ' -victim ' selection_cli_attack_smb: CommandLine|contains|all: - '-smb ' - '--smbkeyword ' CommandLine|contains: - interactive - secrets - service-add selection_cli_attack_rbcd_main: CommandLine|contains: '-rbcd ' selection_cli_attack_rbcd_options: CommandLine|contains: - '-cn ' - '--computername ' selection_cli_attack_changepass: CommandLine|contains: '-chp ' CommandLine|contains|all: - '-chpPass ' - '-chpUser ' selection_cli_attack_addgrpname: CommandLine|contains|all: - '-addgroupmember ' - '-group ' - '-groupuser ' condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb falsepositives: - Unlikely level: high
Sigma rule: Shadow Copies creation using operating systems utilities, possible credential access. Logsource: windows / process_creation. Rule: title: Shadow Copies Creation Using Operating Systems Utilities id: b17ea6f7-6e90-447e-a799-e6c0a493d6ce status: test description: Shadow Copies creation using operating systems utilities, possible credential access references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/ author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003 - attack.t1003.002 - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE selection_cli: CommandLine|contains|all: - shadow - create condition: all of selection_* falsepositives: - Legitimate administrator working with shadow copies, access for backup purposes level: medium
Sigma rule: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing event. Logsource: windows / registry_event. Rule: title: Disable Security Events Logging Adding Reg Key MiniNt id: 919f2ef0-be2d-4a7a-b635-eb2b41fde044 status: test description: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events. references: - https://twitter.com/0gtweet/status/1182516740955226112 - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Ilyas Ochkov, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_event product: windows detection: selection: - TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt EventType: CreateKey - NewName: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt condition: selection falsepositives: - Unknown level: high