Query: write Sigma for Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is oft
Matching passage: Sigma rule: Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is oft. Logsource: windows / process_creation. Rule: title: Suspicious Autorun Registry Modified via WMI id: c80e66d8-1780-48a9-b412-46663fd21ac0 status: experimental description: 'Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. ' references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.001 - attack.t1047 logsource: category: process_creation product: windows detection: selection_execution_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - ParentImage|endswith: \wmiprvse.exe selection_execution_cmd: CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: CommandLine|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: CommandLine|contains: :\Users\ selection_suspicious_paths_user_2: CommandLine|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos condition: all of selection_execution_* and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_*)) falsepositives: - Legitimate administrative activity or software installations level: high
Near-miss passage: Sigma rule: Detects executables located in potentially suspicious directories initiating network connections towards file sharing do. Logsource: windows / network_connection. Rule: title: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 related: - id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153 type: obsolete - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains. references: - https://twitter.com/M_haggis/status/900741347035889665 - https://twitter.com/M_haggis/status/1032799638213066752 - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2018-08-30 modified: 2026-03-29 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection_paths: Image|contains: - :\$Recycle.bin - :\Perflogs\ - :\Temp\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Fonts\ - :\Windows\IME\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Temp\ - \config\systemprofile\ - \Windows\addins\ selection_domains: Initiated: 'true' DestinationHostname|endswith: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.co.nz - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudfl