Query: write Sigma for Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Activ
Matching passage: Sigma rule: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Activ. Logsource: windows / ps_script. Rule: title: Manipulation of User Computer or Group Security Principals Across AD id: b29a93fb-087c-4b5b-a84d-ee3309e69d08 status: test description: 'Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0 author: frack113 date: 2021-12-28 tags: - attack.persistence - attack.t1136.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: System.DirectoryServices.AccountManagement condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript,. Logsource: windows / registry_event. Rule: title: Registry Tampering by Potentially Suspicious Processes id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 related: - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a type: similar - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf type: similar status: experimental description: 'Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence. ' references: - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-08-13 modified: 2026-04-14 tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: registry_event product: windows detection: selection: Image|endswith: - \mshta.exe - \wscript.exe - \cscript.exe filter_main_binary_data: Details: Binary Data filter_main_null: Details: null filter_main_wscript_legit_1: Image|endswith: \wscript.exe TargetObject|contains: - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\ - \Services\bam\State\UserSettings\S-1- - Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\ - Software\Microsoft\Windows\CurrentVersion\Internet Settings\ filter_main_wscript_legit_2: Image|endswith: \wscript.exe TargetObject|contains: \wscript.exe condition: selection and not 1 of filter_main_* falsepositives: - Some legitimate admin or install scripts may use these processes for registry modifications. level: medium