Query: alert when Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C
Matching passage: Sigma rule: Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C. Logsource: windows / registry_delete. Rule: title: Removal of Potential COM Hijacking Registry Keys id: 96f697b0-b499-4e5d-9908-a67bec11cdb6 status: test description: 'Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks. ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/7 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md - https://learn.microsoft.com/en-us/windows/win32/shell/launch - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: \shell\open\command filter_main_explorer: Image|endswith: C:\Windows\explorer.exe filter_main_svchost: Image: C:\Windows\system32\svchost.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_generic_prorams: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_openwith: Image: C:\Windows\System32\OpenWith.exe filter_optional_dropbox: Image|endswith: \Dropbox.exe TargetObject|contains: \Dropbox. filter_optional_wireshark: Image|endswith: \AppData\Local\Temp\Wireshark_uninstaller.exe TargetObject|contains: \wireshark-capture-file\ filter_optional_peazip: Image|contains: peazip TargetObject|contains: \PeaZip. filter_optional_everything: Image|endswith: \Everything.exe TargetObject|contains: \Everything. filter_optional_uninstallers: Image|startswith: C:\Windows\Installer\MSI filter_optional_java: Image|startswith: C:\Program Files (x86)\Java\ Image|endswith: \installer.exe TargetObject|contains: \Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} filter_optional_edgeupdate: Image|contains: \Microsoft\EdgeUpdate\Install filter_optional_avira: Image: - C:\Program Files (x86)\Avira\Antivirus\ - C:\Program Files\Avira\Antivirus\ TargetObject|endswith: - \CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command - \AntiVir.Keyfile\shell\open\command filter_optiona
Near-miss passage: Sigma rule: Detects disabling security tools. Logsource: linux / syslog. Rule: title: Disabling Security Tools - Builtin id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36 related: - id: e3a8a052-111f-4606-9aee-f28ebeb76776 type: derived status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: syslog detection: keywords: - stopping iptables - stopping ip6tables - stopping firewalld - stopping cbdaemon - stopping falcon-sensor condition: keywords falsepositives: - Legitimate administration activities level: medium