Query: detection rule: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
Matching passage: Sigma rule: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.. Logsource: windows / security. Rule: title: Important Windows Event Auditing Disabled id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 related: - id: 69aeb277-f15f-4d2d-b32a-55e883609563 type: derived status: test description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-20 modified: 2023-11-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection_state_success_and_failure: EventID: 4719 SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: - '%%8448' - '%%8450' selection_state_success_only: EventID: 4719 SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: '%%8448' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directori. Logsource: windows / registry_event. Rule: title: Suspicious Run Key from Download id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be status: test description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories references: - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/ - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems) date: 2019-10-01 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_event product: windows detection: selection: Image|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - \Downloads\ - \Temporary Internet Files\Content.Outlook\ - \Local Settings\Temporary Internet Files\ TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Software installers downloaded and used by users level: high