Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Visual Studio Tools for Office id: 9d15044a-7cfe-4d23-8085-6ebc11df7685 status: test description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. references: - https://twitter.com/_vivami/status/1347925307643355138 - https://vanmieghem.io/stealth-outlook-persistence/ author: Bhabesh Raj date: 2021-01-10 modified: 2026-01-09 tags: - attack.t1137.006 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Office\Outlook\Addins\ - \Software\Microsoft\Office\Word\Addins\ - \Software\Microsoft\Office\Excel\Addins\ - \Software\Microsoft\Office\Powerpoint\Addins\ - \Software\Microsoft\VSTO\Security\Inclusion\ filter_main_system: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - C:\Windows\SysWOW64\regsvr32.exe filter_main_office_click_to_run: Image|startswith: - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_integrator: Image: - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe filter_main_office_apps: Image|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE - C:\PROGRA~2\MICROS~2\Office Image|endswith: - \excel.exe - \Integrator.exe - \OneNote.exe - \outlook.exe - \powerpnt.exe - \Teams.exe - \visio.exe - \winword.exe filter_main_vsto: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\VSTO\ - C:\Program Files (x86)\Microsoft Shared\VSTO\ Image|endswith: \VSTOInstaller.exe filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Addin Installation level: medium
Near-miss passage: Sigma rule: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro. Logsource: windows / process_creation. Rule: title: Bypass UAC via Fodhelper.exe id: 7f741dcf-fc22-4759-87b4-9ae8376676a2 status: test description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \fodhelper.exe condition: selection falsepositives: - Legitimate use of fodhelper.exe utility by legitimate user level: high