Query: detect Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location in logs
Matching passage: Sigma rule: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Potentially Suspicious ODBC Driver Registered id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4 status: test description: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location references: - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-23 modified: 2023-08-17 tags: - attack.credential-access - attack.persistence - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\ TargetObject|endswith: - \Driver - \Setup Details|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Registration\CRMLog - :\Windows\System32\com\dmp\ - :\Windows\System32\FxsTmp\ - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - :\Windows\System32\spool\drivers\color\ - :\Windows\System32\spool\PRINTERS\ - :\Windows\System32\spool\SERVERS\ - :\Windows\System32\Tasks_Migrated\ - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\SysWOW64\com\dmp\ - :\Windows\SysWOW64\FxsTmp\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic W. Logsource: windows / registry_set. Rule: title: Registry Hide Function from User id: 5a93eb65-dffa-4543-b761-94aa60098fb6 status: test description: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAPower - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume Details: DWORD (0x00000001) selection_set_0: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor Details: DWORD (0x00000000) condition: 1 of selection_set_* falsepositives: - Legitimate admin script level: medium