Query: detection rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te
Matching passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.. Logsource: windows / process_creation. Rule: title: HackTool - Default PowerSploit/Empire Scheduled Task Creation id: 56c217c3-2de2-479b-990f-5c109ba8458f status: test description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration. references: - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1 - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py author: Markus Neis, @Karneades date: 2018-03-06 modified: 2023-03-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.s0111 - attack.g0022 - attack.g0060 - car.2013-08-001 - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - powershell.exe -NonI - /TN Updater /TR CommandLine|contains: - /SC ONLOGON - /SC DAILY /ST - /SC ONIDLE - /SC HOURLY condition: selection falsepositives: - Unlikely level: high