Query: Sigma rule for Detects the modification of the registry to disable a system restore on the computer
Matching passage: Sigma rule: Detects the modification of the registry to disable a system restore on the computer. Logsource: windows / registry_set. Rule: title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 related: - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 type: similar status: test description: Detects the modification of the registry to disable a system restore on the computer references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Policies\Microsoft\Windows NT\SystemRestore - \Microsoft\Windows NT\CurrentVersion\SystemRestore TargetObject|endswith: - DisableConfig - DisableSR Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Near-miss passage: Sigma rule: Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she. Logsource: kubernetes / audit. Rule: title: Kubernetes Potential Enumeration Activity id: 597a7e84-187d-458b-9e4f-2f5a0e676711 status: experimental description: 'Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like ''Rakkess'' (access_matrix) and ''TruffleHog'' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster. ' references: - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ - https://github.com/trufflesecurity/trufflehog - https://github.com/corneliusweig/rakkess author: uniqu3-us3r date: 2026-04-28 tags: - attack.execution - attack.discovery - attack.t1609 - attack.t1613 logsource: product: kubernetes service: audit detection: selection_status: responseStatus.code: ALLOW selection_request_uri: requestURI|contains: - '%2fbin%2fash' - '%2fbin%2fbash' - '%2fbin%2fbusybox' - '%2fbin%2fdash' - '%2fbin%2fsh' - '%2fbin%2fzsh' - /bin/ash - /bin/bash - /bin/busybox - /bin/dash - /bin/sh - /bin/zsh - '%2fusr%2fbin%2fcurl' - '%2fusr%2fbin%2fkubectl' - '%2fusr%2fbin%2fperl' - '%2fusr%2fbin%2fpython' - '%2fusr%2fbin%2fwget' - /usr/bin/curl - /usr/bin/kubectl - /usr/bin/perl - /usr/bin/python - /usr/bin/wget selection_request_user_agent: userAgent|contains: - access_matrix - trufflehog - azurehound - micro-scanner condition: selection_status and 1 of selection_request_* falsepositives: - Authorized administrative maintenance via kubectl - Automated internal infrastructure monitoring and certificate rotation - Security-approved vulnerability or secret scanning in DevSecOps pipelines level: medium