Query: Sigma rule for Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators cr
Matching passage: Sigma rule: Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators cr. Logsource: windows / registry_set. Rule: title: Directory Service Restore Mode(DSRM) Registry Value Tampering id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 related: - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 type: similar status: test description: 'Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization''s Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used. ' references: - https://adsecurity.org/?p=1785 - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/ - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials author: Nischal Khadgi date: 2024-07-11 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior filter_main_default_value: Details: DWORD (0x00000000) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg". Logsource: windows / file_event. Rule: title: Suspicious File Created Via OneNote Application id: fcc6d700-68d9-4241-9a1a-06874d621b06 status: test description: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/MaD_c4t/status/1623414582382567424 - https://labs.withsecure.com/publications/detecting-onenote-abuse - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/ - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-09 modified: 2023-02-27 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \onenote.exe - \onenotem.exe - \onenoteim.exe TargetFilename|contains: \AppData\Local\Temp\OneNote\ TargetFilename|endswith: - .bat - .chm - .cmd - .dll - .exe - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf condition: selection falsepositives: - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote. - Occasional FPs might occur if OneNote is used internally to share different embedded documents level: high