Query: Sigma rule for Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Matching passage: Sigma rule: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Startup Folder id: 0e20c89d-2264-44ae-8238-aeeaba609ece status: test description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence. references: - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-02 modified: 2023-06-22 tags: - attack.persistence - attack.t1137 logsource: category: file_event product: windows detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP selection_word_extension: TargetFilename|endswith: - .doc - .docm - .docx - .dot - .dotm - .rtf selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART selection_excel_extension: TargetFilename|endswith: - .xls - .xlsm - .xlsx - .xlt - .xltm filter_main_office: Image|endswith: - \WINWORD.exe - \EXCEL.exe condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office falsepositives: - Loading a user environment from a backup or a domain controller - Synchronization of templates level: high
Near-miss passage: Sigma rule: Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hij. Logsource: windows / security. Rule: title: Service Registry Key Read Access Request id: 11d00fff-5dc3-428c-8184-801f292faec0 status: test description: 'Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. ' references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team date: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows service: security definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule' detection: selection: EventID: 4663 ObjectName|contains|all: - \SYSTEM\ - ControlSet\Services\ AccessList|contains: '%%1538' condition: selection falsepositives: - Likely from legitimate applications reading their key. Requires heavy tuning level: low