Query: detection rule: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something un
Matching passage: Sigma rule: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something un. Logsource: windows / registry_set. Rule: title: Uncommon Microsoft Office Trusted Location Added id: f742bde7-9528-42e5-bd82-84f51a8387d2 related: - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac type: derived status: test description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions. references: - Internal Research - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-09-29 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Security\Trusted Locations\Location TargetObject|endswith: \Path filter_exclude_known_paths: Details|contains: - '%APPDATA%\Microsoft\Templates' - '%%APPDATA%%\Microsoft\Templates' - '%APPDATA%\Microsoft\Word\Startup' - '%%APPDATA%%\Microsoft\Word\Startup' - :\Program Files (x86)\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office (x86)\Templates - :\Program Files\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office\Templates\ filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_* falsepositives: - Other unknown legitimate or custom paths need to be filtered to avoid false positives level: high
Near-miss passage: Sigma rule: Detects suspicious ways to run Invoke-Execution using IEX alias. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell IEX Execution Patterns id: 09576804-7a05-458e-a817-eb718ca91f54 status: test description: Detects suspicious ways to run Invoke-Execution using IEX alias references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2 - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-03-24 modified: 2022-11-28 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_combined_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' | iex;' - ' | iex ' - ' | iex}' - ' | IEX ;' - ' | IEX -Error' - ' | IEX (new' - ');IEX ' selection_combined_2: CommandLine|contains: - ::FromBase64String - '.GetString([System.Convert]::' selection_standalone: CommandLine|contains: - )|iex;$ - );iex($ - );iex $ - ' | IEX | ' - ' | iex\"' condition: all of selection_combined_* or selection_standalone falsepositives: - Legitimate scripts that use IEX level: high