Query: detection rule: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directori
Matching passage: Sigma rule: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directori. Logsource: windows / registry_event. Rule: title: Suspicious Run Key from Download id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be status: test description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories references: - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/ - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems) date: 2019-10-01 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_event product: windows detection: selection: Image|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - \Downloads\ - \Temporary Internet Files\Content.Outlook\ - \Local Settings\Temporary Internet Files\ TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Software installers downloaded and used by users level: high
Near-miss passage: Sigma rule: Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening. Logsource: windows / file_event. Rule: title: Suspicious File Created in Outlook Temporary Directory id: fabb0e80-030c-4e3e-a104-d09676991ac3 related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: obsolete status: experimental description: 'Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code. ' references: - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-22 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows category: file_event detection: selection_extension: TargetFilename|endswith: - .cpl - .hta - .iso - .rdp - .svg - .vba - .vbe - .vbs selection_location: - TargetFilename|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - TargetFilename|contains|all: - \AppData\Local\Microsoft\Windows\ - \Content.Outlook\ condition: all of selection_* falsepositives: - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments level: high