Query: Sigma rule for Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persis
Matching passage: Sigma rule: Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persis. Logsource: windows / registry_set. Rule: title: ServiceDll Hijack id: 612e47e9-8a59-43a6-b404-f48683f45bd6 status: test description: 'Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ author: frack113 date: 2022-02-04 modified: 2024-04-03 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\ - ControlSet - \Services\ TargetObject|endswith: \Parameters\ServiceDll filter_main_printextensionmanger: Details: C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll filter_main_domain_controller: Image: C:\Windows\system32\lsass.exe TargetObject|endswith: \Services\NTDS\Parameters\ServiceDll Details: '%%systemroot%%\system32\ntdsa.dll' filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_optional_safetica: Image|endswith: \regsvr32.exe Details: C:\Windows\System32\STAgent.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative scripts - Installation of a service level: medium
Near-miss passage: Sigma rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry. Logsource: windows / network_connection. Rule: title: Network Communication With Crypto Mining Pool id: fa5b1358-b040-4403-9868-15f7d9ab6329 status: stable description: 'Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. ' references: - https://www.poolwatch.io/coin/monero - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-26 modified: 2026-07-24 tags: - attack.impact - attack.t1496 logsource: category: network_connection product: windows detection: selection: DestinationHostname: - aeon-pool.com - alimabi.cn - ap.luckpool.net - api.fastpool.xyz - auto.c3pool.org - awgoaigartnj-xmr.com - backup.fastpool.xyz - bcn.pool.minergate.com - bcn.vip.pool.minergate.com - bizxmr.cc - bmpool.org - bohemianpool.com - byw.dscloud.me - c3.wptask.cyou - c3pool.org - ca-aipg.miningocean.org - ca-dynex.miningocean.org - ca-neurai.miningocean.org - ca-qrl.miningocean.org - ca-upx.miningocean.org - ca-zephyr.miningocean.org - ca.minexmr.com - ca.monero.herominers.com - cbd.monerpool.org - cbdv2.monerpool.org - community-pools.mysrv.cloud - covid19crypto.com - cryptmonero.com - crypto-pool.fr - crypto-pool.info - cryptominded.com - cryptonight-hub.miningpoolhub.com - d1pool.ddns.net - d5pool.us - daili01.monerpool.org - de-aipg.miningocean.org - de-dynex.miningocean.org - de-zephyr.miningocean.org - de.minexmr.com - de.moneroocean.stream - de.salvium.herominers.com - de.zephyr.herominers.com - dl.nbminer.com - donate.graef.in - donate.ssl.xmrig.com - donate.v2.xmrig.com - donate.xmrig.com - donate2.graef.in - drill.moneroworld.com - dwarfpool.com - emercoin.com - emercoin.net - emergate.net - ethereumpool.co - eu.luckpool.net - eu.minerpool.pw - f2pool.com - fastpool.xyz - fcn-xmr.pool.minergate.com - fee.xmrig.com - fi.moneroocean.stream - fr-aipg.miningocean.org - fr-dynex.miningocean.org - fr-neurai.miningocean.org - fr-qrl.miningocean.org - fr-tarirx.luckypool.io - fr-upx.miningocean.org - fr-zephyr.miningocean.org - fr.minexmr.com - fr.moneroocean.stream - friendspool.club - ftp.fastpool.xyz - gandalph3000.com - googleminer.com - grin.2miners.com - gulf.moneroocean.stream - hellominer.com - herominers.com - hk-aipg.miningocean.org - hk-dynex.