Query: Sigma YAML for windows / registry_add
Matching passage: Sigma rule: Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cl. Logsource: windows / registry_add. Rule: title: Potential Persistence Via Disk Cleanup Handler - Registry id: d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a status: test description: 'Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager''s UI. Although Windows comes with a number of disk cleanup handlers, they aren''t designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler. ' references: - https://persistence-info.github.io/Data/diskcleanuphandler.html - https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-02-07 tags: - attack.persistence logsource: product: windows category: registry_add detection: selection: EventType: CreateKey TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\ filter_main_default_keys: TargetObject|endswith: - \Active Setup Temp Folders - \BranchCache - \Content Indexer Cleaner - \D3D Shader Cache - \Delivery Optimization Files - \Device Driver Packages - \Diagnostic Data Viewer database files - \Downloaded Program Files - \DownloadsFolder - \Feedback Hub Archive log files - \Internet Cache Files - \Language Pack - \Microsoft Office Temp Files - \Offline Pages Files - \Old ChkDsk Files - \Previous Installations - \Recycle Bin - \RetailDemo Offline Content - \Setup Log Files - \System error memory dump files - \System error minidump files - \Temporary Files - \Temporary Setup Files - \Temporary Sync Files - \Thumbnail Cache - \Update Cleanup - \Upgrade Discarded Files - \User file versions - \Windows Defender - \Windows Error Reporting Files - \Windows ESD installation files - \Windows Upgrade Log Files condition: selection and not 1 of filter_main_* falsepositives: - Legitimate new entry added by windows level: medium
Near-miss passage: Sigma rule: Detects loading of known malicious drivers via the file name of the drivers.. Logsource: windows / driver_load. Rule: title: Malicious Driver Load By Name id: 39b64854-5497-4b57-a448-40977b8c9679 status: test description: Detects loading of known malicious drivers via the file name of the drivers. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-03 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: ImageLoaded|endswith: - \wfshbr64.sys - \ktmutil7odm.sys - \ktes.sys - \a26363e7b02b13f2b8d697abb90cd5c3.sys - \kt2.sys - \4748696211bd56c2d93c21cab91e82a5.sys - \malicious.sys - \a236e7d654cd932b7d11cb604629a2d0.sys - \spwizimgvt.sys - \c94f405c5929cfcccc8ad00b42c95083.sys - \fur.sys - \wantd.sys - \windbg.sys - \4118b86e490aed091b1a219dba45f332.sys - \gmer64.sys - \1fc7aeeff3ab19004d2e53eae8160ab1.sys - \poortry2.sys - \wintapix.sys - \daxin_blank6.sys - \6771b13a53b9c7449d4891e427735ea2.sys - \blacklotus_driver.sys - \air_system10.sys - \dkrtk.sys - \7.sys - \sense5ext.sys - \ktgn.sys - \ndislan.sys - \nlslexicons0024uvn.sys - \be6318413160e589080df02bb3ca6e6a.sys - \4.sys - \wantd_2.sys - \e29f6311ae87542b3d693c1f38e4e3ad.sys - \daxin_blank3.sys - \gftkyj64.sys - \daxin_blank2.sys - \wantd_4.sys - \reddriver.sys - \834761775.sys - \mlgbbiicaihflrnh.sys - \mjj0ge.sys - \daxin_blank.sys - \daxin_blank5.sys - \poortry1.sys - \msqpq.sys - \mimidrv.sys - \e939448b28a4edc81f1f974cebf6e7d2.sys - \prokiller64.sys - \nodedriver.sys - \wantd_3.sys - \lctka.sys - \kapchelper_x64.sys - \daxin_blank4.sys - \a9df5964635ef8bd567ae487c3d214c4.sys - \wantd_6.sys - \ntbios.sys - \wantd_5.sys - \pciecubed.sys - \mimikatz.sys - \nqrmq.sys - \2.sys - \poortry.sys - \ntbios_2.sys - \fgme.sys - \telephonuafy.sys - \typelibde.sys - \daxin_blank1.sys - \ef0e1725aaf0c6c972593f860531a2ea.sys - \5a4fe297c7d42539303137b6d75b150d.sys condition: selection falsepositives: - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version. - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible) level: medium