Query: Sigma rule for Detects modification of Windows Registry Classes keys used for persistence. Adversaries modify these autostart extensibi
Matching passage: Sigma rule: Detects modification of Windows Registry Classes keys used for persistence. Adversaries modify these autostart extensibi. Logsource: windows / registry_set. Rule: title: Classes Autorun Keys Modification id: 9df5f547-c86a-433e-b533-f2794357e242 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: 'Detects modification of Windows Registry Classes keys used for persistence. Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed. Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths, thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_classes_base: TargetObject|contains: \Software\Classes selection_classes_target: TargetObject|contains: - \Folder\ShellEx\ExtShellFolderViews - \Folder\ShellEx\DragDropHandlers - \Folder\Shellex\ColumnHandlers - \Filter - \Exefile\Shell\Open\Command\(Default) - \Directory\Shellex\DragDropHandlers - \Directory\Shellex\CopyHookHandlers - \CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance - \CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance - \CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance - \CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance - \Classes\AllFileSystemObjects\ShellEx\DragDropHandlers - \.exe - \.cmd - \ShellEx\PropertySheetHandlers - \ShellEx\ContextMenuHandlers filter_main_drivers: Image: C:\Windows\System32\drvinst.exe filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: \lnkfile\shellex\ContextMenuHandlers\ filter_optional_msoffice: Details: '{807583E5-5146-11D5-A672-00B0D022E945}' condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate admi
Near-miss passage: Sigma rule: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certi. Logsource: windows / certificateservicesclient-lifecycle-system. Rule: title: Certificate Exported From Local Certificate Store id: 58c0bff0-40a0-46e8-b5e8-b734b84d2017 status: test description: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. references: - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Zach Mathis date: 2023-05-13 tags: - attack.credential-access - attack.t1649 logsource: product: windows service: certificateservicesclient-lifecycle-system detection: selection: EventID: 1007 condition: selection falsepositives: - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed level: medium