Query: rule covering Running Chrome VPN Extensions via the Registry install 2 vpn extension
Matching passage: Sigma rule: Running Chrome VPN Extensions via the Registry install 2 vpn extension. Logsource: windows / registry_set. Rule: title: Running Chrome VPN Extensions via the Registry 2 VPN Extension id: b64a026b-8deb-4c1d-92fd-98893209dff1 status: test description: Running Chrome VPN Extensions via the Registry install 2 vpn extension references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension author: frack113 date: 2021-12-28 modified: 2023-08-17 tags: - attack.initial-access - attack.persistence - attack.t1133 logsource: category: registry_set product: windows detection: chrome_ext: TargetObject|contains: Software\Wow6432Node\Google\Chrome\Extensions TargetObject|endswith: update_url chrome_vpn: TargetObject|contains: - fdcgdnkidjaadafnichfpabhfomcebme - fcfhplploccackoneaefokcmbjfbkenj - bihmplhobchoageeokmgbdihknkjbknd - gkojfkhlekighikafcpjkiklfbnlmeio - jajilbjjinjmgcibalaakngmkilboobh - gjknjjomckknofjidppipffbpoekiipm - nabbmpekekjknlbkgpodfndbodhijjem - kpiecbcckbofpmkkkdibbllpinceiihk - nlbejmccbhkncgokjcmghpfloaajcffj - omghfjlpggmjjaagoclmmobgdodcjboh - bibjcjfmgapbfoljiojpipaooddpkpai - mpcaainmfjjigeicjnlkdfajbioopjko - jljopmgdobloagejpohpldgkiellmfnc - lochiccbgeohimldjooaakjllnafhaid - nhnfcgpcbfclhfafjlooihdfghaeinfc - ookhnhpkphagefgdiemllfajmkdkcaim - namfblliamklmeodpcelkokjbffgmeoo - nbcojefnccbanplpoffopkoepjmhgdgh - majdfhpaihoncoakbjgbdhglocklcgno - lnfdmdhmfbimhhpaeocncdlhiodoblbd - eppiocemhmnlbhjplcgkofciiegomcon - cocfojppfigjeefejbpfmedgjbpchcng - foiopecknacmiihiocgdjgbjokkpkohc - hhdobjgopfphlmjbmnpglhfcgppchgje - jgbaghohigdbgbolncodkdlpenhcmcge - inligpkjkhbpifecbdjhmdpcfhnlelja - higioemojdadgdbhbbbkfbebbdlfjbip - hipncndjamdcmphkgngojegjblibadbe - iolonopooapdagdemdoaihahlfkncfgg - nhfjkakglbnnpkpldhjmpmmfefifedcj - jpgljfpmoofbmlieejglhonfofmahini - fgddmllnllkalaagkghckoinaemmogpe - ejkaocphofnobjdedneohbbiilggdlbi - keodbianoliadkoelloecbhllnpiocoi - hoapmlpnmpaehilehggglehfdlnoegck - poeojclicodamonabcabmapamjkkmnnk - dfkdflfgjdajbhocmfjolpjbebdkcjog - kcdahmgmaagjhocpipbodaokikjkampi - klnkiajpmpkkkgpgbogmcgfjhdoljacg - lneaocagcijjdpkcabeanfpdbmapcjjg - pgfpignfckbloagkfnamnolkeaecfgfh - jplnlifepflhkbkgonidnobkakhmpnmh - jliodmnojccaloajphkingdnpljdhdok - hnmpcagpplmpfojmgmnngilcnanddlhb - ffbkglfijbcbgblgflchnbphjdllaogb - kcndmbbelllkmioekdagahekgimemejo - jdgilggpfmjpbodmhndmhojklgfdlhob - bihhflimonbpcfagfadcnbbdngpopnjb - ppajinakbfocjfnijggfndbdmjggcmde - oofgbpoabipfcfjapgnbbjjaenockbdp
Near-miss passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / registry_set. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 related: - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a type: similar - id: 55f0a3a1-846e-40eb-8273-677371b8d912 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high