Query: Sigma rule for Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the load
Matching passage: Sigma rule: Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the load. Logsource: windows / registry_set. Rule: title: Windows Vulnerable Driver Blocklist Disabled id: d526c60a-e236-4011-b165-831ffa52ab70 related: - id: 22154f0e-5132-4a54-aa78-cc62f6def531 type: similar status: experimental description: 'Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers, and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques. This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later. Note that this change will require a reboot to take effect, and this rule only detects the registry modification action. ' references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\CI\Config\VulnerableDriverBlocklistEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely and should be investigated immediately. level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml
Near-miss passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / wmi. Rule: title: WMI Persistence id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-02-10 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: wmi definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher detection: wmi_filter_to_consumer_binding: EventID: 5861 consumer_keywords: - ActiveScriptEventConsumer - CommandLineEventConsumer - CommandLineTemplate wmi_filter_registration: EventID: 5859 filter_scmevent: Provider: SCM Event Provider Query: select * from MSFT_SCMEventLogEvent User: S-1-5-32-544 PossibleCause: Permanent condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent falsepositives: - Unknown (data set is too small; further testing needed) level: medium