Query: rule covering Detects the import of a alternate datastream to the registry with regedit.exe.
Matching passage: Sigma rule: Detects the import of a alternate datastream to the registry with regedit.exe.. Logsource: windows / process_creation. Rule: title: Imports Registry Key From an ADS id: 0b80ade5-6997-4b1d-99a1-71701778ea61 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: similar status: test description: Detects the import of a alternate datastream to the registry with regedit.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2024-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains: - ' /i ' - .reg CommandLine|re: :[^ \\] filter: CommandLine|contains|windash: - ' -e ' - ' -a ' - ' -c ' condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / pipe_created. Rule: title: Alternate PowerShell Hosts Pipe id: 58cb02d5-78ce-4692-b3e1-dce850aae41a related: - id: ac7102b4-9e1e-4802-9b4f-17c5524c015c type: derived status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-09-12 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost filter_main_generic: - Image|contains: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\system32\dsac.exe - :\Windows\system32\inetsrv\w3wp.exe - :\Windows\System32\sdiagnhost.exe - :\Windows\system32\ServerManager.exe - :\Windows\system32\wbem\wmiprvse.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe - Image|contains|all: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe - Image|contains|all: - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe filter_optional_sqlserver: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ Image|contains: \Microsoft SQL Server\ Image|endswith: \Tools\Binn\SQLPS.exe filter_optional_azure_connected_machine_agent: Image|startswith: C:\Program Files\AzureConnectedMachineAgent\GCArcService Image|endswith: \GC\gc_worker.exe filter_optional_citrix: Image|startswith: C:\Program Files\Citrix\ filter_optional_exchange: Image|startswith: C:\Program Files\Microsoft\Exchange Se