Query: rule covering Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting
Matching passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Near-miss passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high