deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: NET NGenAssemblyUsageLog Registry Key Tamper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-11-18
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the NGenAssemblyUsageLog registry key.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "SOFTWARE\\Microsoft\\.NETFramework\\NGenAssemblyUsageLog"
  },
  "condition": "selection"
}

References:
  - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
Sigma Detection Rule: Potential ClickFix Execution Pattern - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-03-25
ATT&CK techniques: T1204.001
Log source: windows/registry_set

Description:
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links.
ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.
Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,
such as one-liners that execute remotely hosted malicious files or scripts.


Detection logic:
{
  "selection_registry": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\"
  },
  "selection_details": {
    "Details|contains": [
      "http://",
      "https://"
    ]
  },
  "selection_susp_pattern": [
    {
      "Details|contains": [
        "account",
        "anti-bot",
        "botcheck",
        "captcha",
        "challenge",
        "confirmation",
        "fraud",
        "human",
        "identification",
        "identificator",
        "identity",
        "robot",
        "validation",
        "verification",
        "verify"
      ]
    },
    {
      "Details|contains": [
        "%comspec%",
        "bitsadmin",
        "certutil",
        "cmd",
        "cscript",
        "curl",
        "finger",
        "mshta",
        "powershell",
        "pwsh",
        "regsvr32",
        "rundll32",
        "schtasks",
        "wget",
        "wscript"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/JohnHammond/recaptcha-phish
  - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
  - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
  - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
Sigma Detection Rule: Displaying Hidden Files Feature Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-02
ATT&CK techniques: T1564.001
Log source: windows/registry_set

Description:
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
This technique is abused by several malware families to hide their files from normal users.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
      "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
Sigma Detection Rule: Windows Recall Feature Enabled - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sajid Nawaz Khan
Date: 2024-06-02
ATT&CK techniques: T1113
Log source: windows/registry_set

Description:
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0".
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\Policies\\Microsoft\\Windows\\WindowsAI\\DisableAIDataAnalysis",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
  - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
Sigma Detection Rule: Execution DLL of Choice Using WAB.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-13
ATT&CK techniques: T1218
Log source: windows/registry_set

Description:
This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\Microsoft\\WAB\\DLLPath"
  },
  "filter": {
    "Details": "%CommonProgramFiles%\\System\\wab32.dll"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]64932352
  - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
Sigma Detection Rule: Windows Event Log Access Tampering Via Registry
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: X__Junior
Date: 2025-01-16
ATT&CK techniques: T1547.001, T1112
Log source: windows/registry_set

Description:
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".


Detection logic:
{
  "selection_key_1": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\",
    "TargetObject|endswith": "\\CustomSD"
  },
  "selection_key_2": {
    "TargetObject|contains": [
      "\\Policies\\Microsoft\\Windows\\EventLog\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels"
    ],
    "TargetObject|endswith": "\\ChannelAccess"
  },
  "selection_details": [
    {
      "Details|contains": "D:(D;"
    },
    {
      "Details|contains|all": [
        "D:(",
        ")(D;"
      ]
    }
  ],
  "filter_main_trustedinstaller": {
    "Image": "C:\\Windows\\servicing\\TrustedInstaller.exe"
  },
  "filter_main_tiworker": {
    "Image|startswith": "C:\\Windows\\WinSxS\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "filter_optional_empty": {
    "Image": ""
  },
  "filter_optional_null": {
    "Image": null
  },
  "condition": "1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
  - https://www.youtube.com/watch?v=uSYvHUVU8xY
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
Sigma Detection Rule: Suspicious Environment Variable Has Been Registered
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-20
Log source: windows/registry_set

Description:
Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings

Detection logic:
{
  "selection_main": {
    "TargetObject|contains": "\\Environment\\"
  },
  "selection_details": [
    {
      "Details": [
        "powershell",
        "pwsh"
      ]
    },
    {
      "Details|contains": [
        "\\AppData\\Local\\Temp\\",
        "C:\\Users\\Public\\",
        "TVqQAAMAAAAEAAAA",
        "TVpQAAIAAAAEAA8A",
        "TVqAAAEAAAAEABAA",
        "TVoAAAAAAAAAAAAA",
        "TVpTAQEAAAAEAAAA",
        "SW52b2tlL",
        "ludm9rZS",
        "JbnZva2Ut",
        "SQBuAHYAbwBrAGUALQ",
        "kAbgB2AG8AawBlAC0A",
        "JAG4AdgBvAGsAZQAtA"
      ]
    },
    {
      "Details|startswith": [
        "SUVY",
        "SQBFAF",
        "SQBuAH",
        "cwBhA",
        "aWV4",
        "aQBlA",
        "R2V0",
        "dmFy",
        "dgBhA",
        "dXNpbm",
        "H4sIA",
        "Y21k",
        "cABhAH",
        "Qzpc",
        "Yzpc"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://infosec.exchange/@sbousseaden/[PII_REDACTED]4022664
Sigma Detection Rule: Suspicious Space Characters in TypedPaths Registry Path - FileFix
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-04
ATT&CK techniques: T1204.004, T1027.010
Log source: windows/registry_set

Description:
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.


Detection logic:
{
  "selection_key": {
    "TargetObject|endswith": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\\url1",
    "Details|contains": "#"
  },
  "selection_space_variation": {
    "Details|contains": [
      "\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000",
      "\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001",
      "\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002",
      "\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003",
      "\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004",
      "\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005",
      "\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006",
      "\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007",
      "\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008",
      "\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009",
      "\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a",
      "\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0",
      "            "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://mrd0x.com/filefix-clickfix-alternative/
Sigma Detection Rule: COM Hijack via Sdclt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Omkar Gudhate
Date: 2020-09-27
ATT&CK techniques: T1546, T1548
Log source: windows/registry_set

Description:
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Classes\\Folder\\shell\\open\\command\\DelegateExecute"
  },
  "condition": "selection"
}

References:
  - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass
  - https://www.exploit-db.com/exploits/47696
Sigma Detection Rule: System Scripts Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "scripts_base": {
    "TargetObject|contains": "\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts"
  },
  "scripts": {
    "TargetObject|contains": [
      "\\Startup",
      "\\Shutdown",
      "\\Logon",
      "\\Logoff"
    ]
  },
  "filter": {
    "Details": "(Empty)"
  },
  "condition": "scripts_base and scripts and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Add DisallowRun Execution to Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect set DisallowRun to 1 to prevent user running specific computer program

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1112/T1112.md
Sigma Detection Rule: PowerShell Script Execution Policy Enabled
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-10-18
Log source: windows/registry_set

Description:
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Policies\\Microsoft\\Windows\\PowerShell\\EnableScripts",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
Sigma Detection Rule: Potential PendingFileRenameOperations Tampering
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-01-27
ATT&CK techniques: T1036.003
Log source: windows/registry_set

Description:
Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.


Detection logic:
{
  "selection_main": {
    "TargetObject|contains": "\\CurrentControlSet\\Control\\Session Manager\\PendingFileRenameOperations"
  },
  "selection_susp_paths": {
    "Image|contains": "\\Users\\Public\\"
  },
  "selection_susp_images": {
    "Image|endswith": [
      "\\reg.exe",
      "\\regedit.exe"
    ]
  },
  "condition": "selection_main and 1 of selection_susp_*"
}

References:
  - https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6
  - https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
  - https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html
  - https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html
Sigma Detection Rule: Potential Persistence Using DebugPath
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-07-27
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detects potential persistence using Appx DebugPath

Detection logic:
{
  "selection_debug": {
    "TargetObject|contains": "Classes\\ActivatableClasses\\Package\\Microsoft.",
    "TargetObject|endswith": "\\DebugPath"
  },
  "selection_default": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.",
    "TargetObject|endswith": "\\(Default)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
  - https://github.com/rootm0s/WinPwnage
Sigma Detection Rule: ETW Logging Disabled For SCM
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-09
ATT&CK techniques: T1112, T1685
Log source: windows/registry_set

Description:
Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Tracing\\SCM\\Regular\\TracingDisabled",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html
Sigma Detection Rule: Running Chrome VPN Extensions via the Registry 2 VPN Extension
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1133
Log source: windows/registry_set

Description:
Running Chrome VPN Extensions via the Registry install 2 vpn extension

Detection logic:
{
  "chrome_ext": {
    "TargetObject|contains": "Software\\Wow6432Node\\Google\\Chrome\\Extensions",
    "TargetObject|endswith": "update_url"
  },
  "chrome_vpn": {
    "TargetObject|contains": [
      "fdcgdnkidjaadafnichfpabhfomcebme",
      "fcfhplploccackoneaefokcmbjfbkenj",
      "bihmplhobchoageeokmgbdihknkjbknd",
      "gkojfkhlekighikafcpjkiklfbnlmeio",
      "jajilbjjinjmgcibalaakngmkilboobh",
      "gjknjjomckknofjidppipffbpoekiipm",
      "nabbmpekekjknlbkgpodfndbodhijjem",
      "kpiecbcckbofpmkkkdibbllpinceiihk",
      "nlbejmccbhkncgokjcmghpfloaajcffj",
      "omghfjlpggmjjaagoclmmobgdodcjboh",
      "bibjcjfmgapbfoljiojpipaooddpkpai",
      "mpcaainmfjjigeicjnlkdfajbioopjko",
      "jljopmgdobloagejpohpldgkiellmfnc",
      "lochiccbgeohimldjooaakjllnafhaid",
      "nhnfcgpcbfclhfafjlooihdfghaeinfc",
      "ookhnhpkphagefgdiemllfajmkdkcaim",
      "namfblliamklmeodpcelkokjbffgmeoo",
      "nbcojefnccbanplpoffopkoepjmhgdgh",
      "majdfhpaihoncoakbjgbdhglocklcgno",
      "lnfdmdhmfbimhhpaeocncdlhiodoblbd",
      "eppiocemhmnlbhjplcgkofciiegomcon",
      "cocfojppfigjeefejbpfmedgjbpchcng",
      "foiopecknacmiihiocgdjgbjokkpkohc",
      "hhdobjgopfphlmjbmnpglhfcgppchgje",
      "jgbaghohigdbgbolncodkdlpenhcmcge",
      "inligpkjkhbpifecbdjhmdpcfhnlelja",
      "higioemojdadgdbhbbbkfbebbdlfjbip",
      "hipncndjamdcmphkgngojegjblibadbe",
      "iolonopooapdagdemdoaihahlfkncfgg",
      "nhfjkakglbnnpkpldhjmpmmfefifedcj",
      "jpgljfpmoofbmlieejglhonfofmahini",


References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
Sigma Detection Rule: Windows Defender Exclusions Added - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-07-06
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects the Setting of Windows Defender Exclusions

Detection logic:
{
  "selection2": {
    "TargetObject|contains": "\\Microsoft\\Windows Defender\\Exclusions"
  },
  "condition": "selection2"
}

References:
  - https://twitter.com/_nullbind/status/[PII_REDACTED]10543109
Sigma Detection Rule: Internet Explorer DisableFirstRunCustomize Enabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-16
Log source: windows/registry_set

Description:
Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Internet Explorer\\Main\\DisableFirstRunCustomize",
    "Details": [
      "DWORD (0x00000001)",
      "DWORD (0x00000002)"
    ]
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\System32\\ie4uinit.exe"
    ]
  },
  "filter_optional_avira": {
    "Image|contains|all": [
      "\\Temp\\",
      "\\.cr\\avira_"
    ],
    "Details|contains": "DWORD (0x00000001)"
  },
  "filter_optional_foxit": {
    "Image": [
      "C:\\Program Files (x86)\\Foxit Software\\Foxit PDF Reader\\FoxitPDFReader.exe",
      "C:\\Program Files\\Foxit Software\\Foxit PDF Reader\\FoxitPDFReader.exe"
    ],
    "Details|contains": "DWORD (0x00000001)"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
  - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise
Sigma Detection Rule: Potential Persistence Via New AMSI Providers - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections.
Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.


Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\AMSI\\Providers\\",
      "\\SOFTWARE\\WOW6432Node\\Microsoft\\AMSI\\Providers\\"
    ]
  },
  "filter_optional_avast": {
    "Image": [
      "C:\\Program Files\\Avast Software\\Avast\\RegSvr.exe",
      "C:\\Program Files\\Avast Software\\Avast\\x86\\RegSvr.exe"
    ],
    "TargetObject|contains": "\\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}"
  },
  "filter_optional_avg": {
    "Image": [
      "C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe",
      "C:\\Program Files\\AVG\\Antivirus\\x86\\RegSvr.exe"
    ],
    "TargetObject|contains": "\\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}"
  },
  "filter_optional_avira": {
    "Image": "C:\\Program Files\\Avira\\Endpoint Protection SDK\\endpointprotection.exe",
    "TargetObject|contains": "\\{00000001-3DCC-4B48-A82E-E2071FE58E05}"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://persistence-info.github.io/Data/amsi.html
  - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c