Query: detection rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi
Matching passage: Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacke. Logsource: windows / process_creation. Rule: title: Add SafeBoot Keys Via Reg Utility id: d7662ff6-9e97-4596-a61d-9839e32dee8d related: - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de type: similar status: test description: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2024-03-19 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_safeboot: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\SafeBoot selection_flag: CommandLine|contains: - ' copy ' - ' add ' condition: all of selection* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml