Query: write Sigma for Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The
Matching passage: Sigma rule: Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The. Logsource: windows / process_creation. Rule: title: Vulnerable Driver Blocklist Registry Tampering Via CommandLine id: 22154f0e-5132-4a54-aa78-cc62f6def531 related: - id: d526c60a-e236-4011-b165-831ffa52ab70 type: similar status: experimental description: 'Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli_1: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_2: CommandLine|contains|all: - \Control\CI\Config - VulnerableDriverBlocklistEnable condition: all of selection_* falsepositives: - It is very unlikely for legitimate activities to disable the Vulnerable Driver Blocklist via command line tools; thus it is recommended to investigate promptly. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/info.yml
Near-miss passage: Sigma rule: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential. Logsource: windows / ps_script. Rule: title: PowerShell Web Access Installation - PsScript id: 5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f status: test description: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse references: - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 author: Michael Haag date: 2024-09-03 tags: - attack.persistence - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_install: ScriptBlockText|contains: Install-WindowsFeature WindowsPowerShellWebAccess selection_config: ScriptBlockText|contains: Install-PswaWebApplication selection_auth: ScriptBlockText|contains|all: - Add-PswaAuthorizationRule - -UserName * - -ComputerName * condition: 1 of selection_* falsepositives: - Legitimate PowerShell Web Access installations by administrators level: high