deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potentially Suspicious ODBC Driver Registered
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-23
ATT&CK techniques: T1003
Log source: windows/registry_set

Description:
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\ODBC\\ODBCINST.INI\\",
    "TargetObject|endswith": [
      "\\Driver",
      "\\Setup"
    ],
    "Details|contains": [
      ":\\PerfLogs\\",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Registration\\CRMLog",
      ":\\Windows\\System32\\com\\dmp\\",
      ":\\Windows\\System32\\FxsTmp\\",
      ":\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\",
      ":\\Windows\\System32\\spool\\drivers\\color\\",
      ":\\Windows\\System32\\spool\\PRINTERS\\",
      ":\\Windows\\System32\\spool\\SERVERS\\",
      ":\\Windows\\System32\\Tasks_Migrated\\",
      ":\\Windows\\System32\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      ":\\Windows\\SysWOW64\\com\\dmp\\",
      ":\\Windows\\SysWOW64\\FxsTmp\\",
      ":\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\",
      ":\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      ":\\Windows\\Tracing\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: Tamper With Sophos AV Registry Keys
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-02
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects tamper attempts to sophos av functionality via registry key modification

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Sophos Endpoint Defense\\TamperProtection\\Config\\SAVEnabled",
      "\\Sophos Endpoint Defense\\TamperProtection\\Config\\SEDEnabled",
      "\\Sophos\\SAVService\\TamperProtection\\Enabled"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
Sigma Detection Rule: Office Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.
There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.


Detection logic:
{
  "selection_office_root": {
    "TargetObject|contains": [
      "\\Software\\Wow6432Node\\Microsoft\\Office",
      "\\Software\\Microsoft\\Office"
    ]
  },
  "selection_office_details": {
    "TargetObject|contains": [
      "\\Word\\Addins",
      "\\PowerPoint\\Addins",
      "\\Outlook\\Addins",
      "\\Onenote\\Addins",
      "\\Excel\\Addins",
      "\\Access\\Addins",
      "test\\Special\\Perf"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_known_addins": {
    "Image|startswith": [
      "C:\\Program Files\\Microsoft Office\\",
      "C:\\Program Files (x86)\\Microsoft Office\\",
      "C:\\PROGRA~2\\MICROS~2\\Office",
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe",
      "C:\\Windows\\System32\\regsvr32.exe",
      "C:\\Windows\\SysWOW64\\regsvr32.exe "
    ],
    "TargetObject|contains": [
      "\\Excel\\Addins\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\",
      "\\Excel\\Addins\\ExcelPlugInShell.PowerMapConnect\\",
      "\\Excel\\Addins\\NativeShim\\",
      "\\Excel\\Addins\\NativeShim.InquireConnector.1\\",
      "\\Excel\\Addins\\PowerPivotExcelClientAddIn.NativeEntry.1\\",
      "\\Outlook\\AddIns\\AccessAddin.DC\\",
      "\\Outlook\\AddIns\\ColleagueImport.ColleagueImportAddin\\",
      "\\Outlook\\AddIns\\EvernoteCC.EvernoteContactConnector\\",
      "\\Outlook\\AddIns\\EvernoteOLRD.Connect\\",
      "\\Out

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: New DNS ServerLevelPluginDll Installed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-08
ATT&CK techniques: T1574.001, T1112
Log source: windows/registry_set

Description:
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\services\\DNS\\Parameters\\ServerLevelPluginDll"
  },
  "condition": "selection"
}

References:
  - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
  - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
Sigma Detection Rule: Bypass UAC Using SilentCleanup Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nextron Systems
Date: 2022-01-06
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects the setting of the environement variable "windir" to a non default value.
Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task.
The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Environment\\windir"
  },
  "filter_main_default": {
    "Details": "%SystemRoot%"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task
  - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/
  - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign
Sigma Detection Rule: New RUN Key Pointing to Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2018-08-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Detection logic:
{
  "selection_target": {
    "TargetObject|contains": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    ]
  },
  "selection_suspicious_paths_1": {
    "Details|contains": [
      ":\\Perflogs",
      ":\\ProgramData'",
      ":\\Windows\\Temp",
      ":\\Temp",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming",
      ":\\$Recycle.bin",
      ":\\Users\\Default",
      ":\\Users\\public",
      "%temp%",
      "%tmp%",
      "%Public%",
      "%AppData%"
    ]
  },
  "selection_suspicious_paths_user_1": {
    "Details|contains": ":\\Users\\"
  },
  "selection_suspicious_paths_user_2": {
    "Details|contains": [
      "\\Favorites",
      "\\Favourites",
      "\\Contacts",
      "\\Music",
      "\\Pictures",
      "\\Documents",
      "\\Photos"
    ]
  },
  "filter_main_windows_update": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\",
    "Image|startswith": "C:\\Windows\\SoftwareDistribution\\Download\\",
    "Details|contains|all": [
      "rundll32.exe ",
      "C:\\WINDOWS\\system32\\advpack.dll,DelNodeRunDLL32"
    ],
    "Details|contains": [
      "\\AppData\\Local\\Temp\\",
      "C:\\Windows\\Temp\\"
    ]
  },
  "filter_optional_spotify": {
    "Image|endswith": [
      "C:\\Program Files\\Spotify\\Spotify.exe",
      "C:\\Program Files (x86)\\Spotify\\S

References:
  - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: New BgInfo.EXE Custom WMI Query Registry Configuration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Winternals\\BGInfo\\UserFields\\",
    "Details|startswith": "6"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: New Root or CA or AuthRoot Certificate to Store
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-04
ATT&CK techniques: T1490
Log source: windows/registry_set

Description:
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\",
      "\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\",
      "\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\",
      "\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\",
      "\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\",
      "\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\",
      "\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\",
      "\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\",
      "\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\AuthRoot\\Certificates\\"
    ],
    "TargetObject|endswith": "\\Blob",
    "Details": "Binary Data"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
  - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
Sigma Detection Rule: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "selection_wow_nt_current_version_base": {
    "TargetObject|contains": "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion"
  },
  "selection_wow_nt_current_version": {
    "TargetObject|contains": [
      "\\Windows\\Appinit_Dlls",
      "\\Image File Execution Options",
      "\\Drivers32"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_file_exec_options": {
    "Details|endswith": "\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Registry Persistence via Service in Safe Mode
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-04-04
ATT&CK techniques: T1564.001
Log source: windows/registry_set

Description:
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Control\\SafeBoot\\Minimal\\",
      "\\Control\\SafeBoot\\Network\\"
    ],
    "TargetObject|endswith": "\\(Default)",
    "Details": "Service"
  },
  "filter_optional_sophos": {
    "Image": "C:\\WINDOWS\\system32\\msiexec.exe",
    "TargetObject|endswith": [
      "\\Control\\SafeBoot\\Minimal\\SAVService\\(Default)",
      "\\Control\\SafeBoot\\Network\\SAVService\\(Default)"
    ]
  },
  "filter_optional_mbamservice": {
    "Image|endswith": "\\MBAMInstallerService.exe",
    "TargetObject|endswith": "\\MBAMService\\(Default)",
    "Details": "Service"
  },
  "filter_optional_hexnode": {
    "Image": "C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe",
    "TargetObject|endswith": [
      "\\Control\\SafeBoot\\Minimal\\Hexnode Updater\\(Default)",
      "\\Control\\SafeBoot\\Network\\Hexnode Updater\\(Default)",
      "\\Control\\SafeBoot\\Minimal\\Hexnode Agent\\(Default)",
      "\\Control\\SafeBoot\\Network\\Hexnode Agent\\(Default)"
    ],
    "Details": "Service"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
Sigma Detection Rule: Outlook Macro Execution Without Warning Setting Enabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @ScoubiMtl
Date: 2021-04-05
ATT&CK techniques: T1137, T1008, T1546
Log source: windows/registry_set

Description:
Detects the modification of Outlook security setting to allow unprompted execution of macros.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Outlook\\Security\\Level",
    "Details|contains": "0x00000001"
  },
  "condition": "selection"
}

References:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
Sigma Detection Rule: Persistence Via New SIP Provider
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
ATT&CK techniques: T1553.003
Log source: windows/registry_set

Description:
Detects when an attacker register a new SIP provider for persistence and defense evasion

Detection logic:
{
  "selection_root": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\",
      "\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType",
      "\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\",
      "\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType"
    ]
  },
  "selection_dll": {
    "TargetObject|contains": [
      "\\Dll",
      "\\$DLL"
    ]
  },
  "filter": {
    "Details": [
      "WINTRUST.DLL",
      "mso.dll"
    ]
  },
  "filter_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe",
    "TargetObject|contains": "\\CryptSIPDll",
    "Details": "C:\\Windows\\System32\\PsfSip.dll"
  },
  "condition": "all of selection_* and not 1 of filter*"
}

References:
  - https://persistence-info.github.io/Data/codesigning.html
  - https://github.com/gtworek/PSBits/tree/master/SIP
  - https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
Sigma Detection Rule: Lolbas OneDriveStandaloneUpdater.exe Proxy Download
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-05-28
ATT&CK techniques: T1105
Log source: windows/registry_set

Description:
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\OneDrive\\UpdateOfficeConfig\\UpdateRingSettingURLFromOC"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/
Sigma Detection Rule: Disable Internal Tools or Feature in Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec
Date: 2022-03-18
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Detection logic:
{
  "selection_set_1": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisableCMD",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\StartMenuLogOff",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskmgr",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoDispBackgroundPage",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoDispCPL",
      "SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer\\DisableNotificationCenter",
      "SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "selection_set_0": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon",
   

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md
  - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
  - https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl
Sigma Detection Rule: Session Manager Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001, T1546.009
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "session_manager_base": {
    "TargetObject|contains": "\\System\\CurrentControlSet\\Control\\Session Manager"
  },
  "session_manager": {
    "TargetObject|contains": [
      "\\SetupExecute",
      "\\S0InitialCommand",
      "\\KnownDlls",
      "\\Execute",
      "\\BootExecute",
      "\\AppCertDlls"
    ]
  },
  "filter": {
    "Details": "(Empty)"
  },
  "condition": "session_manager_base and session_manager and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Potential Persistence Via Outlook Home Page
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
Date: 2021-06-09
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects potential persistence activity via outlook home page.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Software\\Microsoft\\Office\\",
      "\\Outlook\\WebView\\"
    ],
    "TargetObject|endswith": "\\URL"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
  - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us
  - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
Sigma Detection Rule: Potential Persistence Via Shim Database Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1546.011
Log source: windows/registry_set

Description:
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time


Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\"
    ]
  },
  "filter_main_empty_string": {
    "Details": ""
  },
  "filter_main_empty_value": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-3---registry-key-creation-andor-modification-events-for-sdb
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/