Query: alert when Detects persistence registry keys for Recycle Bin
Matching passage: Sigma rule: Detects persistence registry keys for Recycle Bin. Logsource: windows / registry_event. Rule: title: Registry Persistence Mechanisms in Recycle Bin id: 277efb8f-60be-4f10-b4d3-037802f37167 status: test description: Detects persistence registry keys for Recycle Bin references: - https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf - https://persistence-info.github.io/Data/recyclebin.html - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ author: frack113 date: 2021-11-18 modified: 2022-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection_create: EventType: RenameKey NewName|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open selection_set: EventType: SetValue TargetObject|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default) condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w. Logsource: windows / security. Rule: title: Windows Event Auditing Disabled id: 69aeb277-f15f-4d2d-b32a-55e883609563 related: - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 type: derived status: test description: 'Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways. ' references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit author: '@neu5ron, Nasreddine Bencherchali (Nextron Systems)' date: 2017-11-19 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4719 AuditPolicyChanges|contains: - '%%8448' - '%%8450' filter_main_guid: SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE9217-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low