Query: Sigma rule for Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line too
Matching passage: Sigma rule: Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line too. Logsource: windows / process_creation. Rule: title: Windows Credential Guard Registry Tampering Via CommandLine id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 related: - id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 type: similar - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff type: similar status: experimental description: 'Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags. Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse. ' references: - https://woshub.com/disable-credential-guard-windows/ - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' - 'delete ' - 'del ' - 'Remove-ItemProperty ' - 'rp ' selection_key_base: CommandLine|contains: - \Control\DeviceGuard - \Control\LSA - Software\Policies\Microsoft\Windows\DeviceGuard selection_key_specific: CommandLine|contains: - EnableVirtualizationBasedSecurity - RequirePlatformSecurityFeatures - LsaCfgFlags condition: all of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/info.yml
Near-miss passage: Sigma rule: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation. Logsource: windows / process_creation. Rule: title: Suspicious MSDT Parent Process id: 7a74da6b-ea76-47db-92cc-874ad90df734 status: test description: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ author: Nextron Systems date: 2022-06-01 modified: 2023-02-06 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe - \wsl.exe selection_msdt: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe condition: all of selection_* falsepositives: - Unknown level: high