Query: alert when Detects modification of the registry settings used for Internet Explorer and other Windows components that use these set
Matching passage: Sigma rule: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these set. Logsource: windows / registry_set. Rule: title: Modification of IE Registry Settings id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 status: test description: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry author: frack113 date: 2022-01-22 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings filter_main_dword: Details|startswith: DWORD filter_main_null: Details: null filter_main_office: Details: - 'Cookie:' - 'Visited:' - (Empty) filter_main_path: TargetObject|contains: - \Cache - \ZoneMap - \WpadDecision filter_main_binary: Details: Binary Data filter_optional_accepted_documents: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the PowerShell command lines with special characters. Logsource: windows / process_creation. Rule: title: Potential PowerShell Command Line Obfuscation id: d7bcd677-645d-4691-a8d4-7a5602b780d1 status: test description: Detects the PowerShell command lines with special characters references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) date: 2020-10-15 modified: 2024-04-15 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_re: - CommandLine|re: \+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+ - CommandLine|re: \{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{ - CommandLine|re: \^.*\^.*\^.*\^.*\^ - CommandLine|re: '`.*`.*`.*`.*`' filter_optional_amazonSSM: ParentImage: C:\Program Files\Amazon\SSM\ssm-document-worker.exe filter_optional_defender_atp: CommandLine|contains: - new EventSource("Microsoft.Windows.Sense.Client.Management" - public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Amazon SSM Document Worker - Windows Defender ATP level: high