Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\. Logsource: windows / registry_set. Rule: title: Potential Persistence Via App Paths Default Property id: 707e097c-e20f-4f67-8807-1f72ff4500d6 status: test description: 'Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application''s executable file name to that file''s fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis. ' references: - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.012 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths TargetObject|endswith: - (Default) - Path Details|contains: - \Users\Public - \AppData\Local\Temp\ - \Windows\Temp\ - \Desktop\ - \Downloads\ - '%temp%' - '%tmp%' - iex - Invoke- - rundll32 - regsvr32 - mshta - cscript - wscript - .bat - .hta - .dll - .ps1 condition: selection falsepositives: - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it) level: high
Near-miss passage: Sigma rule: Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow ". Logsource: windows / process_creation. Rule: title: Remote File Download Via Findstr.EXE id: 587254ee-a24b-4335-b3cd-065c0f1f4baa related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_download_1: CommandLine|contains|windash: ' -v ' selection_cli_download_2: CommandLine|contains|windash: ' -l ' selection_cli_download_3: CommandLine|contains: \\\\ condition: selection_findstr and all of selection_cli_download_* falsepositives: - Unknown level: medium