Query: Sigma YAML for windows / registry_delete
Matching passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Near-miss passage: Sigma rule: Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channe. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Network Connection To Notion API id: 7e9cf7b6-e827-11ed-a05b-15959c120003 status: test description: Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2" references: - https://github.com/mttaggart/OffensiveNotion - https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332 author: Gavin Knapp date: 2023-05-03 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: api.notion.com filter_main_notion: Image|endswith: \AppData\Local\Programs\Notion\Notion.exe filter_main_brave: Image|endswith: \brave.exe filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_maxthon: Image|endswith: \maxthon.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_opera: Image|endswith: \opera.exe filter_main_safari: Image|endswith: \safari.exe filter_main_seamonkey: Image|endswith: \seamonkey.exe filter_main_vivaldi: Image|endswith: \vivaldi.exe filter_main_whale: Image|endswith: \whale.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications communicating with the "api.notion.com" endpoint that are not already in the exclusion list. The desktop and browser applications do not appear to be using the API by default unless integrations are configured. level: low