Query: alert when Detects modification of autostart extensibility point (ASEP) in registry.
Matching passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: WinSock2 Autorun Keys Modification id: d6c2ce7e-afb5-4337-9ca4-4b5254ed0565 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: derived status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: winsock_parameters_base: TargetObject|contains: \System\CurrentControlSet\Services\WinSock2\Parameters winsock_parameters: TargetObject|contains: - \Protocol_Catalog9\Catalog_Entries - \NameSpace_Catalog5\Catalog_Entries filter: - Details: (Empty) - Image: C:\Windows\System32\MsiExec.exe - Image: C:\Windows\syswow64\MsiExec.exe condition: winsock_parameters_base and winsock_parameters and not filter falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Near-miss passage: Sigma rule: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths. Logsource: windows / process_creation. Rule: title: Suspicious New Service Creation id: 17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8 related: - id: 7fe71fc9-de3b-432a-8d57-8c809efc10ab type: derived status: test description: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-14 modified: 2022-11-18 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath= selection_posh: CommandLine|contains|all: - New-Service - -BinaryPathName susp_binpath: CommandLine|contains: - powershell - mshta - wscript - cscript - svchost - dllhost - 'cmd ' - cmd.exe /c - cmd.exe /k - cmd.exe /r - rundll32 - C:\Users\Public - \Downloads\ - \Desktop\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - C:\Windows\TEMP\ - \AppData\Local\Temp condition: 1 of selection* and susp_binpath falsepositives: - Unlikely level: high