Query: rule covering Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacke
Matching passage: Sigma rule: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacke. Logsource: windows / process_creation. Rule: title: Add SafeBoot Keys Via Reg Utility id: d7662ff6-9e97-4596-a61d-9839e32dee8d related: - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de type: similar status: test description: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2024-03-19 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_safeboot: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\SafeBoot selection_flag: CommandLine|contains: - ' copy ' - ' add ' condition: all of selection* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml
Near-miss passage: Sigma rule: Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution proc. Logsource: windows / ps_script. Rule: title: Security Software Discovery Via Powershell Script id: 904e8e61-8edf-4350-b59c-b905fc8e810c status: test description: 'Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-16 modified: 2023-10-24 tags: - attack.discovery - attack.t1518.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: - get-process | \? - get-process | where - gps | \? - gps | where selection_field: ScriptBlockText|contains: - Company -like - Description -like - Name -like - Path -like - Product -like selection_keywords: ScriptBlockText|contains: - \*avira\* - \*carbonblack\* - \*cylance\* - \*defender\* - \*kaspersky\* - \*malware\* - \*sentinel\* - \*symantec\* - \*virus\* condition: all of selection_* falsepositives: - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required. - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced level: medium