Query: write Sigma for Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used
Matching passage: Sigma rule: Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used. Logsource: windows / registry_delete. Rule: title: Removal Of AMSI Provider Registry Keys id: 41d1058a-aea7-4952-9293-29eaaf516465 status: test description: Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://seclists.org/fulldisclosure/2020/Mar/45 author: frack113 date: 2021-06-07 modified: 2025-10-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: - '{2781761E-28E0-4109-99FE-B9D127C57AFE}' - '{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}' filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Remove AMSI Provider Reg Key technique: T1562.001 atomic_guid: 13f09b91-c953-438e-845b-b585e51cac9b
Near-miss passage: Sigma rule: Detects scenarios where one can control another users or computers account without having to use their credentials.. Logsource: windows / security. Rule: title: Active Directory User Backdoors id: 300bac00-e041-4ee2-9c36-e262656a6ecc status: test description: Detects scenarios where one can control another users or computers account without having to use their credentials. references: - https://msdn.microsoft.com/en-us/library/cc220234.aspx - https://adsecurity.org/?p=3466 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-04-13 modified: 2024-02-26 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes' detection: selection1: EventID: 4738 filter_empty: AllowedToDelegateTo: - '' - '-' filter_null: AllowedToDelegateTo: null selection_5136_1: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToDelegateTo selection_5136_2: EventID: 5136 ObjectClass: user AttributeLDAPDisplayName: servicePrincipalName selection_5136_3: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_* falsepositives: - Unknown level: high