Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: System Scripts Autorun Keys Modification id: e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: scripts_base: TargetObject|contains: \Software\Policies\Microsoft\Windows\System\Scripts scripts: TargetObject|contains: - \Startup - \Shutdown - \Logon - \Logoff filter: Details: (Empty) condition: scripts_base and scripts and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" fla. Logsource: windows / process_creation. Rule: title: Change PowerShell Policies to an Insecure Level id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ author: frack113 date: 2021-11-01 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe selection_option: CommandLine|contains: - '-executionpolicy ' - ' -ep ' - ' -exec ' selection_level: CommandLine|contains: - Bypass - Unrestricted filter_main_powershell_core: ParentImage: - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\msiexec.exe CommandLine|contains: - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\PowerShell\7\ - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files (x86)\PowerShell\7\ filter_optional_avast: ParentImage|contains: - C:\Program Files\Avast Software\Avast\ - C:\Program Files (x86)\Avast Software\Avast\ - \instup.exe CommandLine|contains: - -ExecutionPolicy ByPass -File "C:\Program Files\Avast Software\Avast - -ExecutionPolicy ByPass -File "C:\Program Files (x86)\Avast Software\Avast\ condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrator scripts level: medium