Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per. Logsource: windows / process_creation. Rule: title: Registry Modification of MS-settings Protocol Handler id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 related: - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 type: similar status: test description: 'Detects registry modifications to the ''ms-settings'' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path. ' references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1548.002 - attack.t1546.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_reg_cli: CommandLine|contains: add selection_pwsh_cli: CommandLine|contains: - New-ItemProperty - Set-ItemProperty - 'ni ' - 'sp ' selection_cli_key: CommandLine|contains: \ms-settings\shell\open\command condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argum. Logsource: windows / image_load. Rule: title: WMIC Loading Scripting Libraries id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 related: - id: 8d63dadf-b91b-4187-87b6-34a1114577ea type: similar - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d type: similar status: test description: 'Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code. ' references: - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html - https://twitter.com/dez_/status/986614411711442944 - https://lolbas-project.github.io/lolbas/Binaries/Wmic/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-17 modified: 2022-10-13 tags: - attack.stealth - attack.t1220 logsource: category: image_load product: windows detection: selection: Image|endswith: \wmic.exe ImageLoaded|endswith: - \jscript.dll - \vbscript.dll condition: selection falsepositives: - The command wmic os get lastbootuptime loads vbscript.dll - The command wmic os get locale loads vbscript.dll - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights - The command `wmic ntevent` loads vbscript.dll level: medium