Query: Sigma rule for Detects modification of autostart extensibility point (ASEP) in registry.
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Session Manager Autorun Keys Modification id: 046218bd-e0d8-4113-a3c3-895a12b2b298 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - attack.t1546.009 logsource: category: registry_set product: windows detection: session_manager_base: TargetObject|contains: \System\CurrentControlSet\Control\Session Manager session_manager: TargetObject|contains: - \SetupExecute - \S0InitialCommand - \KnownDlls - \Execute - \BootExecute - \AppCertDlls filter: Details: (Empty) condition: session_manager_base and session_manager and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t. Logsource: windows / security. Rule: title: Important Scheduled Task Deleted/Disabled id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-03-13 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection: EventID: - 4699 - 4701 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\Schedule - \Windows\ExploitGuard filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: $ TaskName|contains: \Windows\Windows Defender\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034