Query: rule covering Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools
Matching passage: Sigma rule: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools. Logsource: windows / registry_event. Rule: title: Sticky Key Like Backdoor Usage - Registry id: baca5663-583c-45f9-b5dc-ea96a22ce542 status: test description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen references: - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/ - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community date: 2018-03-15 modified: 2022-11-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 - car.2014-11-003 - car.2014-11-008 logsource: category: registry_event product: windows detection: selection_registry: TargetObject|endswith: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisplaySwitch.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atbroker.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger condition: selection_registry falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This c. Logsource: windows / network_connection. Rule: title: Potential Remote PowerShell Session Initiated id: c539afac-c12a-46ed-b1bd-5a5567c9f045 status: test description: 'Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection. ' references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2024-02-02 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 logsource: category: network_connection product: windows detection: selection: DestinationPort: - 5985 - 5986 Initiated: 'true' SourceIsIpv6: 'false' filter_main_service_users: - User|contains: - NETWORK SERVICE - NETZWERKDIENST - SERVICIO DE RED - SERVIZIO DI RETE - User|contains|all: - SERVICE R - SEAU filter_main_localhost: SourceIp: - ::1 - 127.0.0.1 DestinationIp: - ::1 - 127.0.0.1 filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\AvastSvc.exe - C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring. - Network Service user name of a not-covered localization level: high