Query: Sigma rule for Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Matching passage: Sigma rule: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Potentially Suspicious ODBC Driver Registered id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4 status: test description: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location references: - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-23 modified: 2023-08-17 tags: - attack.credential-access - attack.persistence - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\ TargetObject|endswith: - \Driver - \Setup Details|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Registration\CRMLog - :\Windows\System32\com\dmp\ - :\Windows\System32\FxsTmp\ - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - :\Windows\System32\spool\drivers\color\ - :\Windows\System32\spool\PRINTERS\ - :\Windows\System32\spool\SERVERS\ - :\Windows\System32\Tasks_Migrated\ - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\SysWOW64\com\dmp\ - :\Windows\SysWOW64\FxsTmp\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these set. Logsource: windows / registry_set. Rule: title: Modification of IE Registry Settings id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 status: test description: Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry author: frack113 date: 2022-01-22 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings filter_main_dword: Details|startswith: DWORD filter_main_null: Details: null filter_main_office: Details: - 'Cookie:' - 'Visited:' - (Empty) filter_main_path: TargetObject|contains: - \Cache - \ZoneMap - \WpadDecision filter_main_binary: Details: Binary Data filter_optional_accepted_documents: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents condition: selection_domains and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: low