deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Shell Open Command Registry Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-24
ATT&CK techniques: T1548.002, T1546.001
Log source: windows/registry_set

Description:
Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence.
Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files,
and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\shell\\open\\command\\",
    "Details|contains": [
      "\\$Recycle.Bin\\",
      "\\AppData\\Local\\Temp\\",
      "\\Contacts\\",
      "\\Music\\",
      "\\PerfLogs\\",
      "\\Photos\\",
      "\\Pictures\\",
      "\\Users\\Public\\",
      "\\Videos\\",
      "\\Windows\\Temp\\",
      "%AppData%",
      "%LocalAppData%",
      "%Temp%",
      "%tmp%"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/25/f/water-curse.html
Sigma Detection Rule: CurrentControlSet Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "system_control_base": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\Control"
  },
  "system_control_keys": {
    "TargetObject|contains": [
      "\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram",
      "\\Terminal Server\\Wds\\rdpwd\\StartupPrograms",
      "\\SecurityProviders\\SecurityProviders",
      "\\SafeBoot\\AlternateShell",
      "\\Print\\Providers",
      "\\Print\\Monitors",
      "\\NetworkProvider\\Order",
      "\\Lsa\\Notification Packages",
      "\\Lsa\\Authentication Packages",
      "\\BootVerificationProgram\\ImagePath"
    ]
  },
  "filter_empty": {
    "Details": "(Empty)"
  },
  "filter_cutepdf": {
    "Image": "C:\\Windows\\System32\\spoolsv.exe",
    "TargetObject|contains": "\\Print\\Monitors\\CutePDF Writer Monitor",
    "Details": [
      "cpwmon64_v40.dll",
      "CutePDF Writer"
    ]
  },
  "filter_onenote": {
    "Image": "C:\\Windows\\System32\\spoolsv.exe",
    "TargetObject|contains": "Print\\Monitors\\Appmon\\Ports\\Microsoft.Office.OneNote_",
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe",
    "TargetObject|endswith": "\\NetworkProvider\\Order\\ProviderOrder"
  },
  "filter_realvnc": {
    "Image": "C:\\Windows\\System32\\spoolsv.exe",
    "TargetObject|endswith": "\\Print\\Monitors\\MONVNC\\Driver",
    "Details": "VNCpm.dll"
  },
  "condition": "all of system_control_* and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Uncommon Extension In Keyboard Layout IME File Registry Value
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-11-21
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Control\\Keyboard Layouts\\",
      "Ime File"
    ]
  },
  "filter_main_known_extension": {
    "Details|endswith": ".ime"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
Sigma Detection Rule: Winlogon AllowMultipleTSSessions Enable
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects when the 'AllowMultipleTSSessions' value is enabled.
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllowMultipleTSSessions",
    "Details|endswith": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Sigma Detection Rule: Disable Tamper Protection on Windows Defender
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-04
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects disabling Windows Defender Tamper Protection

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows Defender\\Features\\TamperProtection",
    "Details": "DWORD (0x00000000)"
  },
  "filter_msmpeng_client": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "Image|endswith": "\\MsMpEng.exe"
  },
  "filter_msmpeng_domain_controller": {
    "Image": "C:\\Program Files\\Windows Defender\\MsMpEng.exe"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html
Sigma Detection Rule: UAC Bypass Abusing Winsat Path Parsing - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Root\\InventoryApplicationFile\\winsat.exe|",
    "TargetObject|endswith": "\\LowerCaseLongPath",
    "Details|startswith": "c:\\users\\",
    "Details|endswith": "\\appdata\\local\\temp\\system32\\winsat.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious Shim Database Patching Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-01
ATT&CK techniques: T1546.011
Log source: windows/registry_set

Description:
Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\",
    "TargetObject|endswith": [
      "\\csrss.exe",
      "\\dllhost.exe",
      "\\explorer.exe",
      "\\RuntimeBroker.exe",
      "\\services.exe",
      "\\sihost.exe",
      "\\svchost.exe",
      "\\taskhostw.exe",
      "\\winlogon.exe",
      "\\WmiPrvSe.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Sigma Detection Rule: Potential Registry Persistence Attempt Via DbgManagedDebugger
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-07
ATT&CK techniques: T1574
Log source: windows/registry_set

Description:
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\.NETFramework\\DbgManagedDebugger"
  },
  "filter": {
    "Details": "\"C:\\Windows\\system32\\vsjitdebugger.exe\" PID %d APPDOM %d EXTEXT \"%s\" EVTHDL %d"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
  - https://github.com/last-byte/PersistenceSniper
Sigma Detection Rule: Registry Modification for OCI DLL Redirection
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-24
ATT&CK techniques: T1112, T1574.001
Log source: windows/registry_set

Description:
Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings.
Threat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.


Detection logic:
{
  "selection_ocilib": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\MSDTC\\MTxOCI\\OracleOciLib"
  },
  "filter_main_ocilib_file": {
    "Details|contains": "oci.dll"
  },
  "selection_ocilibpath": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\MSDTC\\MTxOCI\\OracleOciLibPath"
  },
  "filter_main_ocilibpath": {
    "Details|contains": "%SystemRoot%\\System32\\"
  },
  "condition": "(selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath)"
}

References:
  - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
Sigma Detection Rule: Suspicious Application Allowed Through Exploit Guard
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings

Detection logic:
{
  "selection_key": {
    "TargetObject|contains": "SOFTWARE\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\AllowedApplications"
  },
  "selection_paths": {
    "TargetObject|contains": [
      "\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\PerfLogs\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/
Sigma Detection Rule: Allow RDP Remote Assistance Feature
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "System\\CurrentControlSet\\Control\\Terminal Server\\fAllowToGetHelp",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1112/T1112.md
Sigma Detection Rule: Windows Vulnerable Driver Blocklist Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-26
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers,
and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers,
particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques.
This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later.
Note that this change will require a reboot to take effect, and this rule only detects the registry modification action.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Control\\CI\\Config\\VulnerableDriverBlocklistEnable",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
  - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
Sigma Detection Rule: Enabling COR Profiler Environment Variables
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops)
Date: 2020-09-10
ATT&CK techniques: T1574.012
Log source: windows/registry_set

Description:
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Detection logic:
{
  "selection_1": {
    "TargetObject|endswith": [
      "\\COR_ENABLE_PROFILING",
      "\\COR_PROFILER",
      "\\CORECLR_ENABLE_PROFILING"
    ]
  },
  "selection_2": {
    "TargetObject|contains": "\\CORECLR_PROFILER_PATH"
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/jamieantisocial/status/[PII_REDACTED]48668673
  - https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
  - https://www.sans.org/cyber-security-summit/archives
  - https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
Sigma Detection Rule: Wow6432Node Classes Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "wow_classes_base": {
    "TargetObject|contains": "\\Software\\Wow6432Node\\Classes"
  },
  "wow_classes": {
    "TargetObject|contains": [
      "\\Folder\\ShellEx\\ExtShellFolderViews",
      "\\Folder\\ShellEx\\DragDropHandlers",
      "\\Folder\\ShellEx\\ColumnHandlers",
      "\\Directory\\Shellex\\DragDropHandlers",
      "\\Directory\\Shellex\\CopyHookHandlers",
      "\\CLSID\\{AC[PII_REDACTED]-4E11-9862-C17BE5A1767E}\\Instance",
      "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance",
      "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance",
      "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance",
      "\\AllFileSystemObjects\\ShellEx\\DragDropHandlers",
      "\\ShellEx\\PropertySheetHandlers",
      "\\ShellEx\\ContextMenuHandlers"
    ]
  },
  "filter": {
    "Details": "(Empty)"
  },
  "condition": "wow_classes_base and wow_classes and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Suspicious Service Installed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
Date: 2019-04-08
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders.
Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)


Detection logic:
{
  "selection": {
    "TargetObject": [
      "HKLM\\System\\CurrentControlSet\\Services\\NalDrv\\ImagePath",
      "HKLM\\System\\CurrentControlSet\\Services\\PROCEXP152\\ImagePath"
    ]
  },
  "filter": {
    "Image|endswith": [
      "\\procexp64.exe",
      "\\procexp.exe",
      "\\procmon64.exe",
      "\\procmon.exe",
      "\\handle.exe",
      "\\handle64.exe"
    ],
    "Details|contains": "\\WINDOWS\\system32\\Drivers\\PROCEXP152.SYS"
  },
  "condition": "selection and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4230/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
Sigma Detection Rule: New ODBC Driver Registered
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-23
Log source: windows/registry_set

Description:
Detects the registration of a new ODBC driver.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\ODBC\\ODBCINST.INI\\",
    "TargetObject|endswith": "\\Driver"
  },
  "filter_main_sqlserver": {
    "TargetObject|contains": "\\SQL Server\\",
    "Details": "%WINDIR%\\System32\\SQLSRV32.dll"
  },
  "filter_optional_office_access": {
    "TargetObject|contains": "\\Microsoft Access ",
    "Details|startswith": "C:\\Progra",
    "Details|endswith": "\\ACEODBC.DLL"
  },
  "filter_optional_office_excel": {
    "TargetObject|contains": "\\Microsoft Excel Driver",
    "Details|startswith": "C:\\Progra",
    "Details|endswith": "\\ACEODBC.DLL"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: CurrentVersion Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "selection_current_version_base": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion"
  },
  "selection_current_version_keys": {
    "TargetObject|contains": [
      "\\ShellServiceObjectDelayLoad",
      "\\Run\\",
      "\\RunOnce\\",
      "\\RunOnceEx\\",
      "\\RunServices\\",
      "\\RunServicesOnce\\",
      "\\Policies\\System\\Shell",
      "\\Policies\\Explorer\\Run",
      "\\Group Policy\\Scripts\\Startup",
      "\\Group Policy\\Scripts\\Shutdown",
      "\\Group Policy\\Scripts\\Logon",
      "\\Group Policy\\Scripts\\Logoff",
      "\\Explorer\\ShellServiceObjects",
      "\\Explorer\\ShellIconOverlayIdentifiers",
      "\\Explorer\\ShellExecuteHooks",
      "\\Explorer\\SharedTaskScheduler",
      "\\Explorer\\Browser Helper Objects",
      "\\Authentication\\PLAP Providers",
      "\\Authentication\\Credential Providers",
      "\\Authentication\\Credential Provider Filters"
    ]
  },
  "filter_main_generic_all": [
    {
      "Details": "(Empty)"
    },
    {
      "TargetObject|endswith": "\\NgcFirst\\ConsecutiveSwitchCount"
    },
    {
      "Image|endswith": [
        "\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
        "\\AppData\\Roaming\\Spotify\\Spotify.exe",
        "\\AppData\\Local\\WebEx\\WebexHost.exe"
      ]
    },
    {
      "Image": [
        "C:\\WINDOWS\\system32\\devicecensus.exe",
        "C:\\Windows\\system32\\winsat.exe",
        "C:\\Program Files\\Microsoft OneDrive\\Standa

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
Sigma Detection Rule: Usage of Renamed Sysinternals Tools - RegistrySet
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1588.002
Log source: windows/registry_set

Description:
Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\PsExec",
      "\\ProcDump",
      "\\Handle",
      "\\LiveKd",
      "\\Process Explorer",
      "\\PsLoglist",
      "\\PsPasswd",
      "\\Active Directory Explorer"
    ],
    "TargetObject|endswith": "\\EulaAccepted"
  },
  "filter_main_image_names": {
    "Image|endswith": [
      "\\PsExec.exe",
      "\\PsExec64.exe",
      "\\procdump.exe",
      "\\procdump64.exe",
      "\\handle.exe",
      "\\handle64.exe",
      "\\livekd.exe",
      "\\livekd64.exe",
      "\\procexp.exe",
      "\\procexp64.exe",
      "\\psloglist.exe",
      "\\psloglist64.exe",
      "\\pspasswd.exe",
      "\\pspasswd64.exe",
      "\\ADExplorer.exe",
      "\\ADExplorer64.exe"
    ]
  },
  "filter_optional_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: PowerShell Logging Disabled Via Registry Key Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-04-02
ATT&CK techniques: T1564.001, T1112
Log source: windows/registry_set

Description:
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Microsoft\\Windows\\PowerShell\\",
      "\\Microsoft\\PowerShellCore\\"
    ],
    "TargetObject|endswith": [
      "\\ModuleLogging\\EnableModuleLogging",
      "\\ScriptBlockLogging\\EnableScriptBlockLogging",
      "\\ScriptBlockLogging\\EnableScriptBlockInvocationLogging",
      "\\Transcription\\EnableTranscripting",
      "\\Transcription\\EnableInvocationHeader",
      "\\EnableScripts"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled