Query: detect Detects suspicious new RUN key element pointing to an executable in a suspicious folder in logs
Matching passage: Sigma rule: Detects suspicious new RUN key element pointing to an executable in a suspicious folder. Logsource: windows / registry_set. Rule: title: New RUN Key Pointing to Suspicious Folder id: 02ee49e2-e294-4d0f-9278-f5b3212fc588 status: experimental description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2018-08-25 modified: 2025-10-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: Details|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: Details|contains: :\Users\ selection_suspicious_paths_user_2: Details|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos filter_main_windows_update: TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\ Image|startswith: C:\Windows\SoftwareDistribution\Download\ Details|contains|all: - 'rundll32.exe ' - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 Details|contains: - \AppData\Local\Temp\ - C:\Windows\Temp\ filter_optional_spotify: Image|endswith: - C:\Program Files\Spotify\Spotify.exe - C:\Program Files (x86)\Spotify\Spotify.exe - \AppData\Roaming\Spotify\Spotify.exe TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Details|endswith: Spotify.exe --autostart --minimized condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software using weird folders for updates level: high
Near-miss passage: Sigma rule: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on. Logsource: windows / process_creation. Rule: title: HackTool - winPEAS Execution id: 98b53e78-ebaf-46f8-be06-421aafd176d9 status: test description: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz references: - https://github.com/carlospolop/PEASS-ng - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation author: Georg Lauenstein (sure[secure]) date: 2022-09-19 modified: 2023-03-23 tags: - attack.privilege-escalation - attack.discovery - attack.t1082 - attack.t1087 - attack.t1046 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: winPEAS.exe - Image|endswith: - \winPEASany_ofs.exe - \winPEASany.exe - \winPEASx64_ofs.exe - \winPEASx64.exe - \winPEASx86_ofs.exe - \winPEASx86.exe selection_cli_option: CommandLine|contains: - ' applicationsinfo' - ' browserinfo' - ' eventsinfo' - ' fileanalysis' - ' filesinfo' - ' processinfo' - ' servicesinfo' - ' windowscreds' selection_cli_dl: CommandLine|contains: https://github.com/carlospolop/PEASS-ng/releases/latest/download/ selection_cli_specific: - ParentCommandLine|endswith: ' -linpeas' - CommandLine|endswith: ' -linpeas' condition: 1 of selection_* falsepositives: - Unlikely level: high