Query: detect Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te in logs
Matching passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation id: f8931561-97f5-4c46-907f-0a4a592e47a7 status: experimental description: 'Detects attempted file load events that did not meet the signing level requirements. It often means the file''s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation. ' references: - https://twitter.com/SBousseaden/status/1483810148602814466 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-20 modified: 2025-02-28 tags: - attack.execution logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3033 - 3034 filter_optional_dtrace: FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll ProcessNameBuffer|endswith: \Windows\System32\svchost.exe RequestedPolicy: 12 filter_optional_av_generic: FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\ FileNameBuffer|endswith: \igd10iumd64.dll RequestedPolicy: 7 filter_optional_electron_based_app: FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll ProcessNameBuffer|endswith: - \AppData\Local\Keybase\Gui\Keybase.exe - \Microsoft\Teams\stage\Teams.exe RequestedPolicy: 8 filter_optional_bonjour: FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll ProcessNameBuffer|endswith: - \Windows\System32\svchost.exe - \Windows\System32\SIHClient.exe RequestedPolicy: - 8 - 12 filter_optional_msoffice_1: FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE FileNameBuffer|endswith: \MSOXMLMF.DLL RequestedPolicy: 7 filter_optional_msoffice_2: ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office FileNameBuffer|contains: \Windows\System32\ RequestedPolicy: 8 filter_optional_slack: FileNameBuffer|endsw