Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the cl. Logsource: windows / process_creation. Rule: title: RunMRU Registry Key Deletion id: c11aecef-9c37-45a6-9c07-bc0782f963fd related: - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55 type: similar status: experimental description: 'Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands. ' references: - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-25 tags: - attack.stealth - attack.t1070.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains|all: - ' del' - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a. Logsource: windows / file_access. Rule: title: Suspicious File Access to Browser Credential Storage id: a1dfd976-4852-41d4-9507-dc6590a3ccd0 status: experimental description: 'Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware. ' references: - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore date: 2025-05-22 tags: - attack.credential-access - attack.t1555.003 - attack.discovery - attack.t1217 logsource: category: file_access product: windows detection: selection_browser_paths: FileName|contains: - \Sputnik\Sputnik - \MapleStudio\ChromePlus - \QIP Surf - \BlackHawk - \7Star\7Star - \CatalinaGroup\Citrio - \Google\Chrome - \Coowon\Coowon - \CocCoc\Browser - \uCozMedia\Uran - \Tencent\QQBrowser - \Orbitum - \Slimjet - \Iridium - \Vivaldi - \Chromium - \GhostBrowser - \CentBrowser - \Xvast - \Chedot - \SuperBird - \360Browser\Browser - \360Chrome\Chrome - \Comodo\Dragon - \BraveSoftware\Brave-Browser - \Torch - \UCBrowser\ - \Blisk - \Epic Privacy Browser - \Nichrome - \Amigo - \Kometa - \Xpom - \Microsoft\Edge - \Liebao7Default\EncryptedStorage - \AVAST Software\Browser - \Kinza - \Mozilla\SeaMonkey\ - \Comodo\IceDragon\ - \8pecxstudios\Cyberfox\ - \FlashPeak\SlimBrowser\ - \Moonchild Productions\Pale Moon\ selection_browser_subpaths: FileName|contains: - \Profiles\ - \User Data selection_cred_files: - FileName|contains: - \Login Data - \Cookies - \EncryptedStorage - \WebCache\ - FileName|endswith: - cert9.db - cookies.sqlite - formhistory.sqlite - key3.db - key4.db - Login Data.sqlite - logins.json - places.sqlite filter_main_img: Image|endswith: - \Sputnik.exe - \ChromePlus.exe - \QIP Surf.exe - \BlackHawk.exe - \7Star.exe - \Sleipnir5.exe - \Citrio.exe - \Chrome SxS.exe - \Chrome.exe - \Coowon.exe - \CocCocBrowser.exe - \Uran.exe - \QQBrowser.exe - \Orbitum.exe - \Slimjet.exe - \Iridium.exe - \Vivaldi.exe - \Chromium.exe - \GhostBrowser.exe - \CentBrowser.exe - \Xvast.exe - \Chedot.exe - \SuperBird.exe - \360Browser.exe - \360Chrome.exe - \dragon.exe - \brave.e