Query: rule covering Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature
Matching passage: Sigma rule: Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation id: f8931561-97f5-4c46-907f-0a4a592e47a7 status: experimental description: 'Detects attempted file load events that did not meet the signing level requirements. It often means the file''s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation. ' references: - https://twitter.com/SBousseaden/status/1483810148602814466 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-20 modified: 2025-02-28 tags: - attack.execution logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3033 - 3034 filter_optional_dtrace: FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll ProcessNameBuffer|endswith: \Windows\System32\svchost.exe RequestedPolicy: 12 filter_optional_av_generic: FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\ FileNameBuffer|endswith: \igd10iumd64.dll RequestedPolicy: 7 filter_optional_electron_based_app: FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll ProcessNameBuffer|endswith: - \AppData\Local\Keybase\Gui\Keybase.exe - \Microsoft\Teams\stage\Teams.exe RequestedPolicy: 8 filter_optional_bonjour: FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll ProcessNameBuffer|endswith: - \Windows\System32\svchost.exe - \Windows\System32\SIHClient.exe RequestedPolicy: - 8 - 12 filter_optional_msoffice_1: FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE FileNameBuffer|endswith: \MSOXMLMF.DLL RequestedPolicy: 7 filter_optional_msoffice_2: ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office FileNameBuffer|contains: \Windows\System32\ RequestedPolicy: 8 filter_optional_slack: FileNameBuffer|endsw
Near-miss passage: Sigma rule: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary. Logsource: windows / registry_event. Rule: title: UAC Bypass Via Wsreset id: 6ea3bf32-9680-422d-9f50-e90716b12a66 status: test description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. references: - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly - https://lolbas-project.github.io/lolbas/Binaries/Wsreset author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command condition: selection falsepositives: - Unknown level: high