Query: detection rule: Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors ma
Matching passage: Sigma rule: Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors ma. Logsource: windows / registry_set. Rule: title: Registry Modification for OCI DLL Redirection id: c0e0bdec-3e3d-47aa-9974-05539c999c89 status: experimental description: 'Detects registry modifications related to ''OracleOciLib'' and ''OracleOciLibPath'' under ''MSDTC'' settings. Threat actors may modify these registry keys to redirect the loading of ''oci.dll'' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service. ' references: - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1112 - attack.t1574.001 logsource: category: registry_set product: windows detection: selection_ocilib: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib filter_main_ocilib_file: Details|contains: oci.dll selection_ocilibpath: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath filter_main_ocilibpath: Details|contains: '%SystemRoot%\System32\' condition: (selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed. Logsource: windows / process_creation. Rule: title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0 status: test description: 'Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM) ' references: - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-03-02 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_group_root: CommandLine|contains: - ' group ' - ' localgroup ' selection_group_flags: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto - ' /do' filter_group_add: CommandLine|contains: ' /add' selection_accounts_root: CommandLine|contains: ' accounts ' selection_accounts_flags: CommandLine|contains: ' /do' condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*) falsepositives: - Inventory tool runs - Administrative activity level: medium