Query: detect Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the in logs
Matching passage: Sigma rule: Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the. Logsource: windows / registry_set. Rule: title: Register New IFiltre For Persistence id: b23818c7-e575-4d13-8012-332075ec0a2b status: test description: 'Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files. ' references: - https://persistence-info.github.io/Data/ifilters.html - https://twitter.com/0gtweet/status/1468548924600459267 - https://github.com/gtworek/PSBits/tree/master/IFilter - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2024-03-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_ext: TargetObject|contains|all: - \SOFTWARE\Classes\. - \PersistentHandler selection_clsid: TargetObject|contains|all: - \SOFTWARE\Classes\CLSID - \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} filter_default_targets: TargetObject|contains: - \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\ - \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\ - \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\ - \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\ - \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\ - \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\ - \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\ - \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\ - \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\ - \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\ - \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\ - \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\ - \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\ - \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\ - \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\ - \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\ - \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\ - \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\ - \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\ - \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\ - \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\ - \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\ - \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\ - \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\ - \CLSID\{eec97550-47a9-11cf-b95
Near-miss passage: Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low