Query: detection rule: Detects possible suspicious glue development endpoint activity.
Matching passage: Sigma rule: Detects possible suspicious glue development endpoint activity.. Logsource: aws / cloudtrail. Rule: title: AWS Glue Development Endpoint Activity id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26 status: test description: Detects possible suspicious glue development endpoint activity. references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html author: Austin Songer @austinsonger date: 2021-10-03 modified: 2022-12-18 tags: - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: glue.amazonaws.com eventName: - CreateDevEndpoint - DeleteDevEndpoint - UpdateDevEndpoint condition: selection falsepositives: - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C. Logsource: windows / registry_delete. Rule: title: Removal of Potential COM Hijacking Registry Keys id: 96f697b0-b499-4e5d-9908-a67bec11cdb6 status: test description: 'Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks. ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/7 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md - https://learn.microsoft.com/en-us/windows/win32/shell/launch - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: \shell\open\command filter_main_explorer: Image|endswith: C:\Windows\explorer.exe filter_main_svchost: Image: C:\Windows\system32\svchost.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_generic_prorams: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_openwith: Image: C:\Windows\System32\OpenWith.exe filter_optional_dropbox: Image|endswith: \Dropbox.exe TargetObject|contains: \Dropbox. filter_optional_wireshark: Image|endswith: \AppData\Local\Temp\Wireshark_uninstaller.exe TargetObject|contains: \wireshark-capture-file\ filter_optional_peazip: Image|contains: peazip TargetObject|contains: \PeaZip. filter_optional_everything: Image|endswith: \Everything.exe TargetObject|contains: \Everything. filter_optional_uninstallers: Image|startswith: C:\Windows\Installer\MSI filter_optional_java: Image|startswith: C:\Program Files (x86)\Java\ Image|endswith: \installer.exe TargetObject|contains: \Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} filter_optional_edgeupdate: Image|contains: \Microsoft\EdgeUpdate\Install filter_optional_avira: Image: - C:\Program Files (x86)\Avira\Antivirus\ - C:\Program Files\Avira\Antivirus\ TargetObject|endswith: - \CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command - \AntiVir.Keyfile\shell\open\command filter_optiona