Query: rule covering Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escala
Matching passage: Sigma rule: Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escala. Logsource: windows / registry_set. Rule: title: Add Port Monitor Persistence in Registry id: 944e8941-f6f6-4ee8-ac05-1c224e923c0e status: test description: 'Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md author: frack113 date: 2021-12-30 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Control\Print\Monitors\ Details|endswith: .dll filter_optional_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver Details: cpwmon64_v40.dll User|contains: - AUTHORI - AUTORI filter_optional_monvnc: TargetObject|contains: \Control\Print\Monitors\MONVNC\Driver filter_optional_vnc: TargetObject|contains|all: - Control\Print\Environments\ - \Drivers\ - \VNC Printer condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml simulation: - type: atomic-red-team name: Add Port Monitor persistence in Registry technique: T1547.010 atomic_guid: d34ef297-f178-4462-871e-9ce618d44e50
Near-miss passage: Sigma rule: Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled ta. Logsource: windows / taskscheduler. Rule: title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar status: test description: 'Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities ' references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: - 141 - 142 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\ - \Windows\ExploitGuard filter_main_user: UserName|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034