Query: Sigma rule for Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr
Matching passage: Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / registry_set. Rule: title: RestrictedAdminMode Registry Value Tampering id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 related: - id: 28ac00d6-22d9-4a3c-927f-bbd770104573 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx author: frack113 date: 2023-01-13 modified: 2024-08-23 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linu. Logsource: linux / process_creation. Rule: title: Potential Suspicious Change To Sensitive/Critical Files id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4 status: test description: 'Detects changes of sensitive and critical files. Monitors files that you don''t expect to change without planning on Linux system. These files include, but are not limited to, system configuration files, authentication files, and critical application files. Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2023-05-30 modified: 2026-03-18 tags: - attack.impact - attack.t1565.001 logsource: category: process_creation product: linux detection: selection_img_1: Image|endswith: - /cat - /echo - /grep - /head - /more - /tail CommandLine|contains: '>' selection_img_2: Image|endswith: - /emacs - /nano - /sed - /vi - /vim selection_paths: CommandLine|contains: - /bin/login - /bin/passwd - /boot/ - /etc/*.conf - /etc/cron. - /etc/crontab - /etc/hosts - /etc/init.d - /etc/sudoers - /opt/bin/ - /sbin - /usr/bin/ - /usr/local/bin/ filter_main_mdadm.conf: Image|endswith: /bin/sed CommandLine|startswith: - sed -i /^* - sed -ne s/^ CommandLine|endswith: /etc/mdadm/mdadm.conf condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_* falsepositives: - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed. level: medium