Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage c. Logsource: windows / registry_set. Rule: title: Potential PendingFileRenameOperations Tampering id: 4eec988f-7bf0-49f1-8675-1e6a510b3a2a status: test description: 'Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot. ' references: - https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6 - https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN - https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html - https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html author: frack113 date: 2023-01-27 modified: 2025-10-07 tags: - attack.stealth - attack.t1036.003 logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \CurrentControlSet\Control\Session Manager\PendingFileRenameOperations selection_susp_paths: Image|contains: \Users\Public\ selection_susp_images: Image|endswith: - \reg.exe - \regedit.exe condition: selection_main and 1 of selection_susp_* falsepositives: - Installers and updaters may set currently in use files for rename or deletion after a reboot. level: medium
Near-miss passage: Sigma rule: Detect standard users login that are part of high privileged groups such as the Administrator group. Logsource: windows / lsa-server. Rule: title: Standard User In High Privileged Group id: 7ac407cc-0f48-4328-aede-de1d2e6fef41 status: test description: Detect standard users login that are part of high privileged groups such as the Administrator group references: - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml author: frack113 date: 2023-01-13 modified: 2023-05-05 tags: - attack.credential-access - attack.privilege-escalation logsource: product: windows service: lsa-server definition: 'Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.' detection: selection: EventID: 300 TargetUserSid|startswith: S-1-5-21- SidList|contains: - S-1-5-32-544 - -500} - -518} - -519} filter_main_admin: TargetUserSid|endswith: - '-500' - '-518' - '-519' condition: selection and not 1 of filter_main_* falsepositives: - Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field level: medium