Query: Sigma rule for Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per
Matching passage: Sigma rule: Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per. Logsource: windows / process_creation. Rule: title: Registry Modification of MS-settings Protocol Handler id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 related: - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 type: similar status: test description: 'Detects registry modifications to the ''ms-settings'' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path. ' references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1548.002 - attack.t1546.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_reg_cli: CommandLine|contains: add selection_pwsh_cli: CommandLine|contains: - New-ItemProperty - Set-ItemProperty - 'ni ' - 'sp ' selection_cli_key: CommandLine|contains: \ms-settings\shell\open\command condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries id: 0ba1da6d-b6ce-4366-828c-18826c9de23e related: - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 type: similar - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed type: derived - id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 type: obsolete - id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 type: obsolete - id: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 type: obsolete status: test description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. references: - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks - https://twitter.com/christophetd/status/1164506034720952320 - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/ - https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113 date: 2019-06-15 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection: - Description: Execute processes remotely - Product: Sysinternals PsExec - Description|startswith: - Windows PowerShell - pwsh - OriginalFileName: - certutil.exe - cmstp.exe - cscript.exe - IE4UINIT.EXE - finger.exe - mshta.exe - msiexec.exe - msxsl.exe - powershell_ise.exe - powershell.exe - psexec.c - psexec.exe - psexesvc.exe - pwsh.dll - reg.exe - regsvr32.exe - rundll32.exe - WerMgr - wmic.exe - wscript.exe filter: Image|endswith: - \certutil.exe - \cmstp.exe - \cscript.exe - \ie4uinit.exe - \finger.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \powershell_ise.exe - \powershell.exe - \psexec.exe - \psexec64.exe - \psexec64a.exe - \PSEXESVC.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \wermgr.exe - \wmic.exe - \wscript.exe condition: selection and not filter falsepositives: - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist - PsExec installed via Windows Store doesn't contain original filename field (False negative) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml