Query: detection rule: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Matching passage: Sigma rule: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. Logsource: windows / registry_set. Rule: title: Bypass UAC Using Event Viewer id: 674202d0-b22a-4af4-ae5f-2eda1f3da1af status: test description: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd author: frack113 date: 2022-01-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: _Classes\mscfile\shell\open\command\(Default) filter: Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %' condition: selection and not filter falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/info.yml simulation: - type: atomic-red-team name: Bypass UAC using Event Viewer (cmd) technique: T1548.002 atomic_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9
Near-miss passage: Sigma rule: Detects suspicious user agent strings used in APT malware in proxy logs. Logsource: proxy. Rule: title: APT User Agent id: 6ec820f2-e963-4801-9127-d8b2dce4d31b status: test description: Detects suspicious user agent strings used in APT malware in proxy logs references: - Internal Research author: Florian Roth (Nextron Systems), Markus Neis date: 2019-11-12 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - SJZJ (compatible; MSIE 6.0; Win32) - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0 - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' - Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit) - webclient - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200 - Mozilla/4.0 (compatible; MSI 6.0; - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/ - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2 - Mozilla/4.0 - Netscape - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1) - Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1) - Mozilla/4.0 (compatible; MSIE 8.0; Win32) - Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 - Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) - Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko - Mozilla v5.1 * - MSIE 8.0 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) - Mozilla/4.0 (compatible; RMS) - Mozilla/4.0 (compatible; MSIE 6.0; DynGate) - O/9.27 (W; U; Z) - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0* - Mozilla/5.0 (Windows NT 9; * - hots scot - Mozilla/5.0 (compatible; MSIE 10.0; Windows NT) - Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 - Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0) - Mozilla/4.0 (compatibl