Query: detection rule: Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the bina
Matching passage: Sigma rule: Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the bina. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via Windows Telemetry id: 73a883d0-0348-4be4-a8d8-51031c2564f8 related: - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5 type: obsolete status: test description: 'Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. ' references: - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/ author: Lednyov Alexey, oscd.community, Sreeman date: 2020-10-16 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\ TargetObject|endswith: \Command Details|contains: - .bat - .bin - .cmd - .dat - .dll - .exe - .hta - .jar - .js - .msi - .ps - .sh - .vb filter_main_generic: Details|contains: - \system32\CompatTelRunner.exe - \system32\DeviceCensus.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious acti. Logsource: windows / process_creation. Rule: title: Response File Execution Via Odbcconf.EXE id: 5f03babb-12db-4eec-8c82-7b4cb5580868 related: - id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 type: similar - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-05 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' selection_rsp_ext: CommandLine|contains: .rsp condition: all of selection_* falsepositives: - The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary. level: medium