Query: rule covering Detects when a program changes the default file association of any extension to an executable. When a file is opened, th
Matching passage: Sigma rule: Detects when a program changes the default file association of any extension to an executable. When a file is opened, th. Logsource: windows / process_creation. Rule: title: Change Default File Association To Executable Via Assoc id: ae6f14e6-14de-45b0-9f44-c0986f50dc89 related: - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061 type: derived status: test description: 'Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - 'assoc ' - exefile filter: CommandLine|contains: .exe=exefile condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects nltest commands that can be used for information discovery. Logsource: windows / process_creation. Rule: title: Potential Recon Activity Via Nltest.EXE id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248 related: - id: 410ad193-a728-4107-bc79-4419789fcbf8 type: similar - id: 903076ff-f442-475a-b667-4f246bcc203b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects nltest commands that can be used for information discovery references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11) - https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest author: Craig Young, oscd.community, Georg Lauenstein date: 2021-07-24 modified: 2023-12-15 tags: - attack.discovery - attack.t1016 - attack.t1482 logsource: category: process_creation product: windows detection: selection_nltest: - Image|endswith: \nltest.exe - OriginalFileName: nltestrk.exe selection_recon: - CommandLine|contains|all: - server - query - CommandLine|contains: - /user - all_trusts - 'dclist:' - 'dnsgetdc:' - domain_trusts - 'dsgetdc:' - parentdomain - trusted_domains condition: all of selection_* falsepositives: - Legitimate administration use but user and host must be investigated level: medium