Query: write Sigma for Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the
Matching passage: Sigma rule: Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the. Logsource: windows / registry_set. Rule: title: Register New IFiltre For Persistence id: b23818c7-e575-4d13-8012-332075ec0a2b status: test description: 'Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files. ' references: - https://persistence-info.github.io/Data/ifilters.html - https://twitter.com/0gtweet/status/1468548924600459267 - https://github.com/gtworek/PSBits/tree/master/IFilter - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2024-03-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_ext: TargetObject|contains|all: - \SOFTWARE\Classes\. - \PersistentHandler selection_clsid: TargetObject|contains|all: - \SOFTWARE\Classes\CLSID - \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} filter_default_targets: TargetObject|contains: - \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\ - \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\ - \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\ - \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\ - \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\ - \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\ - \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\ - \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\ - \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\ - \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\ - \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\ - \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\ - \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\ - \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\ - \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\ - \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\ - \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\ - \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\ - \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\ - \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\ - \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\ - \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\ - \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\ - \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\ - \CLSID\{eec97550-47a9-11cf-b95
Near-miss passage: Sigma rule: Detects the mount of an ISO image on an endpoint. Logsource: windows / security. Rule: title: ISO Image Mounted id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073 status: test description: Detects the mount of an ISO image on an endpoint references: - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages - https://twitter.com/MsftSecIntel/status/1257324139515269121 - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: Syed Hasan (@syedhasan009) date: 2021-05-29 modified: 2023-11-09 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure detection: selection: EventID: 4663 ObjectServer: Security ObjectType: File ObjectName|startswith: \Device\CdRom filter_main_generic: ObjectName: - \Device\CdRom0\autorun.ico - \Device\CdRom0\setup.exe - \Device\CdRom0\setup64.exe condition: selection and not 1 of filter_main_* falsepositives: - Software installation ISO files level: medium