Query: detect Detects modification of autostart extensibility point (ASEP) in registry. in logs
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentVersion NT Autorun Keys Modification id: cbf93e5d-ca6c-4722-8bea-e9119007c248 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_nt_current_version_base: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion selection_nt_current_version: TargetObject|contains: - \Winlogon\VmApplet - \Winlogon\Userinit - \Winlogon\Taskman - \Winlogon\Shell - \Winlogon\GpExtensions - \Winlogon\AppSetup - \Winlogon\AlternateShells\AvailableShells - \Windows\IconServiceLib - \Windows\Appinit_Dlls - \Image File Execution Options - \Font Drivers - \Drivers32 - \Windows\Run - \Windows\Load filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_main_legitimate_subkey: TargetObject|contains: \Image File Execution Options\ TargetObject|endswith: - \DisableExceptionChainValidation - \MitigationOptions filter_main_security_extension_dc: Image: C:\Windows\system32\svchost.exe TargetObject|contains: - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval Details: - DWORD (0x00000001) - DWORD (0x00000009) - DWORD (0x000003c0) filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost filter_optional_edge: Image|startswith: C:\Program Files (x86)\Microsoft\Temp\ Image|endswith: \MicrosoftEdgeUpdate.exe filter_optional_avguard: Image|startswith: - C:\Program Files (x86)\Avira\Antivirus\avguard.exe - C:\Program Files\Avira\Antivirus\avguard.exe TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentV
Near-miss passage: Sigma rule: Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or secur. Logsource: aws / cloudtrail. Rule: title: AWS SAML Provider Deletion Activity id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374 status: experimental description: 'Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it. ' references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html author: Ivan Saakov date: 2024-12-19 tags: - attack.stealth - attack.t1078.004 - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.t1531 - attack.impact logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: DeleteSAMLProvider status: success condition: selection falsepositives: - Automated processes using tools like Terraform may trigger this alert. - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected. - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule. level: medium