Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite). Logsource: windows / registry_set. Rule: title: PUA - Sysinternals Tools Execution - Registry id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 9841b233-8df8-4ad7-9133-b0b4402a9014 type: obsolete status: test description: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2025-10-26 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \Process Explorer - \ProcDump - \PsExec - \PsLoglist - \PsPasswd - \SDelete - \Sysinternals TargetObject|endswith: \EulaAccepted condition: selection falsepositives: - Legitimate use of SysInternals tools. Filter the legitimate paths used in your environment level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml
Near-miss passage: Sigma rule: Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. Logsource: windows / security. Rule: title: Potential Privileged System Service Operation - SeLoadDriverPrivilege id: f63508a0-c809-4435-b3be-ed819394d612 status: test description: 'Detects the usage of the ''SeLoadDriverPrivilege'' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff. ' references: - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673 author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security detection: selection_1: EventID: 4673 PrivilegeList: SeLoadDriverPrivilege Service: '-' filter_main_exact: ProcessName: - C:\Windows\explorer.exe - C:\Windows\HelpPane.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\Dism.exe - C:\Windows\System32\fltMC.exe - C:\Windows\System32\mmc.exe - C:\Windows\System32\rundll32.exe - C:\Windows\System32\RuntimeBroker.exe - C:\Windows\System32\ShellHost.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\SystemSettingsBroker.exe - C:\Windows\System32\wimserv.exe filter_optional_others: ProcessName|endswith: - \AppData\Local\Microsoft\Teams\current\Teams.exe - \Google\Chrome\Application\chrome.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \procmon.exe - \procmon64.exe - \procmon64a.exe filter_main_startswith: ProcessName|startswith: C:\Program Files\WindowsApps\Microsoft filter_optional_dropbox: ProcessName|startswith: - C:\Program Files (x86)\Dropbox\ - C:\Program Files\Dropbox\ ProcessName|endswith: \Dropbox.exe condition: selection_1 and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legimate tools loading drivers. Including but not limited to, Sysinternals, CPU-Z, AVs etc. A baseline needs to be created according to the used