Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The. Logsource: windows / process_creation. Rule: title: Vulnerable Driver Blocklist Registry Tampering Via CommandLine id: 22154f0e-5132-4a54-aa78-cc62f6def531 related: - id: d526c60a-e236-4011-b165-831ffa52ab70 type: similar status: experimental description: 'Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli_1: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_2: CommandLine|contains|all: - \Control\CI\Config - VulnerableDriverBlocklistEnable condition: all of selection_* falsepositives: - It is very unlikely for legitimate activities to disable the Vulnerable Driver Blocklist via command line tools; thus it is recommended to investigate promptly. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/info.yml
Near-miss passage: Sigma rule: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files. Logsource: windows / process_creation. Rule: title: File Download with Headless Browser id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e related: - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c type: derived status: test description: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files references: - https://twitter.com/mrd0x/status/1478234484881436672?s=12 - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Sreeman, Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2025-10-07 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains|all: - --headless - dump-dom - http filter_optional_edge_1: Image|startswith: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files (x86)\Microsoft\EdgeWebView\ - C:\Program Files\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeWebView\ - C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \msedgewebview2.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom filter_optional_edge_2: Image|contains: - \AppData\Local\Microsoft\WindowsApps\ - \Windows\SystemApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml