Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE id: 452bce90-6fb0-43cc-97a5-affc283139b3 status: test description: 'Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91 - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2 - https://tria.ge/241231-j9yatstqbm/behavioral1 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-03-22 modified: 2025-06-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_root_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_root_path: CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\ - SOFTWARE\Policies\Microsoft\Windows Defender Security Center - SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_0: CommandLine|contains|all: - ' add ' - d 0 CommandLine|contains: - DisallowExploitProtectionOverride - EnableControlledFolderAccess - MpEnablePus - PUAProtection - SpynetReporting - SubmitSamplesConsent - TamperProtection selection_dword_1: CommandLine|contains|all: - ' add ' - d 1 CommandLine|contains: - DisableAccess - DisableAntiSpyware - DisableAntiSpywareRealtimeProtection - DisableAntiVirus - DisableAntiVirusSignatures - DisableArchiveScanning - DisableBehaviorMonitoring - DisableBlockAtFirstSeen - DisableCloudProtection - DisableConfig - DisableEnhancedNotifications - DisableIntrusionPreventionSystem - DisableIOAVProtection - DisableNetworkProtection - DisableOnAccessProtection - DisablePrivacyMode - DisableRealtimeMonitoring - DisableRoutinelyTakingAction - DisableScanOnRealtimeEnable - DisableScriptScanning - DisableSecurityCenter - Notification_Suppress - SignatureDisableUpdateOnStartupWithoutEngine condition: all of selection_root_* and 1 of selection_dword_* falsepositives: - Rare legitimate use by administrators to test software (should always be investigated) level: high