Query: Sigma rule for Detects attempts to query system information directly from the Windows Registry.
Matching passage: Sigma rule: Detects attempts to query system information directly from the Windows Registry.. Logsource: windows / process_creation. Rule: title: System Information Discovery via Registry Queries id: 0022869c-49f7-4ff2-ba03-85ac42ddac58 status: experimental description: Detects attempts to query system information directly from the Windows Registry. references: - https://cert.gov.ua/article/6277849 - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md author: lazarg date: 2025-06-12 modified: 2025-10-25 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_cmd_reg: Image|endswith: \reg.exe CommandLine|contains: query CommandLine|contains|windash: -v selection_cmd_powershell: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - Get-ItemPropertyValue - gpv selection_keys: CommandLine|contains: - \SOFTWARE\Microsoft\Windows Defender - \SOFTWARE\Microsoft\Windows NT\CurrentVersion - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation - \SYSTEM\CurrentControlSet\Services condition: 1 of selection_cmd_* and selection_keys falsepositives: - Unlikely level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml simulation: - type: atomic-red-team name: System Information Discovery technique: T1010 atomic_guid: 66703791-c902-4560-8770-42b8a91f7667 - type: atomic-red-team name: Discover OS Product Name via Registry technique: T1082 atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7 - type: atomic-red-team name: Discover OS Build Number via Registry technique: T1082 atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Execution id: b52e84a3-029e-4529-b09b-71d19dd27e94 status: test related: - id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 type: similar description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: frack113 date: 2022-02-11 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH condition: selection falsepositives: - Legitimate use level: medium