deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Persistence Via Event Viewer Events.asp
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-17
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Microsoft\\Windows NT\\CurrentVersion\\Event Viewer\\MicrosoftRedirectionProgram",
      "\\Microsoft\\Windows NT\\CurrentVersion\\Event Viewer\\MicrosoftRedirectionURL"
    ]
  },
  "filter_default_redirect_program": {
    "Image|endswith": "C:\\WINDOWS\\system32\\svchost.exe",
    "TargetObject|endswith": "\\Microsoft\\Windows NT\\CurrentVersion\\Event Viewer\\MicrosoftRedirectionProgram",
    "Details": "%%SystemRoot%%\\PCHealth\\HelpCtr\\Binaries\\HelpCtr.exe"
  },
  "filter_default_redirect_program_cli": {
    "Image|endswith": "C:\\WINDOWS\\system32\\svchost.exe",
    "TargetObject|endswith": "\\Microsoft\\Windows NT\\CurrentVersion\\Event Viewer\\MicrosoftRedirectionProgramCommandLineParameters",
    "Details": "-url hcp://services/centers/support?topic=%%s"
  },
  "filter_url": {
    "Details": "http://go.microsoft.com/fwlink/events.asp"
  },
  "filter_cleaner": {
    "Details": "(Empty)"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]24788480
  - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks
  - https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
  - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md
Sigma Detection Rule: Disable Windows Defender Functionalities Via Registry Keys
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel
Date: 2022-08-01
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Detection logic:
{
  "selection_main": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\Windows Defender\\",
      "\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\",
      "\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\"
    ]
  },
  "selection_dword_1": {
    "TargetObject|endswith": [
      "\\DisableAntiSpyware",
      "\\DisableAntiVirus",
      "\\DisableBehaviorMonitoring",
      "\\DisableBlockAtFirstSeen",
      "\\DisableEnhancedNotifications",
      "\\DisableIntrusionPreventionSystem",
      "\\DisableIOAVProtection",
      "\\DisableOnAccessProtection",
      "\\DisableRealtimeMonitoring",
      "\\DisableScanOnRealtimeEnable",
      "\\DisableScriptScanning"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "selection_dword_0": {
    "TargetObject|endswith": [
      "\\DisallowExploitProtectionOverride",
      "\\Features\\TamperProtection",
      "\\MpEngine\\MpEnablePus",
      "\\PUAProtection",
      "\\Signature Update\\ForceUpdateFromMU",
      "\\SpyNet\\SpynetReporting",
      "\\SpyNet\\SubmitSamplesConsent",
      "\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "filter_optional_symantec": {
    "Image|startswith": "C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\",
    "Image|endswith": "\\sepWscSvc64.exe"
  },
  "condition": "selection_main and 1 of selection_dword_* and not 1 of filter_optional_*"
}

References:
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://gist.github.com/anadr/7465a9fde63d[PII_REDACTED]9f14c21105
  - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
Sigma Detection Rule: Trust Access Disable For VBApplications
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-22
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Security\\AccessVBOM",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/inversecos/status/[PII_REDACTED]21819397
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
  - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
Sigma Detection Rule: IE Change Domain Zone
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1137
Log source: windows/registry_set

Description:
Hides the file extension through modification of the registry

Detection logic:
{
  "selection_domains": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\"
  },
  "filter": {
    "Details": [
      "DWORD (0x00000000)",
      "DWORD (0x00000001)",
      "(Empty)"
    ]
  },
  "condition": "selection_domains and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
  - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
Sigma Detection Rule: Microsoft Office Protected View Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-06-08
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

Detection logic:
{
  "selection_path": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Office\\",
      "\\Security\\ProtectedView\\"
    ]
  },
  "selection_values_1": {
    "Details": "DWORD (0x00000001)",
    "TargetObject|endswith": [
      "\\DisableAttachementsInPV",
      "\\DisableInternetFilesInPV",
      "\\DisableIntranetCheck",
      "\\DisableUnsafeLocationsInPV"
    ]
  },
  "selection_values_0": {
    "Details": "DWORD (0x00000000)",
    "TargetObject|endswith": [
      "\\enabledatabasefileprotectedview",
      "\\enableforeigntextfileprotectedview"
    ]
  },
  "condition": "selection_path and 1 of selection_values_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
  - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/
  - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview
Sigma Detection Rule: Potential Persistence Via GlobalFlags
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Karneades, Jonhnathan Ribeiro, Florian Roth
Date: 2018-04-11
ATT&CK techniques: T1546.012
Log source: windows/registry_set

Description:
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Detection logic:
{
  "selection_global_flag": {
    "TargetObject|contains|all": [
      "\\Microsoft\\Windows NT\\CurrentVersion\\",
      "\\Image File Execution Options\\",
      "\\GlobalFlag"
    ]
  },
  "selection_silent_process": {
    "TargetObject|contains|all": [
      "\\Microsoft\\Windows NT\\CurrentVersion\\",
      "\\SilentProcessExit\\"
    ],
    "TargetObject|contains": [
      "\\ReportingMode",
      "\\MonitorProcess"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
Sigma Detection Rule: Potential Persistence Via Netsh Helper DLL - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Anish Bogati
Date: 2023-11-28
ATT&CK techniques: T1546.007
Log source: windows/registry_set

Description:
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\NetSh",
    "Details|contains": ".dll"
  },
  "filter_main_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe",
    "Details": [
      "ipmontr.dll",
      "iasmontr.dll",
      "ippromon.dll"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
  - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
Sigma Detection Rule: RDP Sensitive Settings Changed to Zero
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
Date: 2022-09-29
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\fDenyTSConnections",
      "\\fSingleSessionPerUser",
      "\\UserAuthentication"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  - https://twitter.com/SagieSec/status/[PII_REDACTED]63624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
  - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
Sigma Detection Rule: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-04-05
ATT&CK techniques: T1137, T1008, T1546
Log source: windows/registry_set

Description:
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Outlook\\LoadMacroProviderOnBoot",
    "Details|contains": "0x00000001"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
Sigma Detection Rule: Add Port Monitor Persistence in Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1547.010
Log source: windows/registry_set

Description:
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Control\\Print\\Monitors\\",
    "Details|endswith": ".dll"
  },
  "filter_optional_cutepdf": {
    "Image": "C:\\Windows\\System32\\spoolsv.exe",
    "TargetObject|contains": "\\Control\\Print\\Monitors\\CutePDF Writer Monitor v4.0\\Driver",
    "Details": "cpwmon64_v40.dll",
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_optional_monvnc": {
    "TargetObject|contains": "\\Control\\Print\\Monitors\\MONVNC\\Driver"
  },
  "filter_optional_vnc": {
    "TargetObject|contains|all": [
      "Control\\Print\\Environments\\",
      "\\Drivers\\",
      "\\VNC Printer"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md
Sigma Detection Rule: DNS-over-HTTPS Enabled by Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-07-22
ATT&CK techniques: T1140, T1112
Log source: windows/registry_set

Description:
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.


Detection logic:
{
  "selection_edge": {
    "TargetObject|endswith": "\\SOFTWARE\\Policies\\Microsoft\\Edge\\BuiltInDnsClientEnabled",
    "Details": "DWORD (0x00000001)"
  },
  "selection_chrome": {
    "TargetObject|endswith": "\\SOFTWARE\\Google\\Chrome\\DnsOverHttpsMode",
    "Details": "secure"
  },
  "selection_firefox": {
    "TargetObject|endswith": "\\SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS\\Enabled",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
  - https://github.com/elastic/detection-rules/issues/1371
  - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
  - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS
Sigma Detection Rule: Potential Persistence Via AppCompat RegisterAppRestart Layer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-01-01
ATT&CK techniques: T1546.011
Log source: windows/registry_set

Description:
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.
This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API.
This can be potentially abused as a persistence mechanism.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\\",
    "Details|contains": "REGISTERAPPRESTART"
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef[PII_REDACTED]543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md
Sigma Detection Rule: Change the Fax Dll
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-07-17
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect possible persistence using Fax DLL load when service restart

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Software\\Microsoft\\Fax\\Device Providers\\",
      "\\ImageName"
    ]
  },
  "filter": {
    "Details": "%systemroot%\\system32\\fxst30.dll"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/dottor_morte/status/[PII_REDACTED]70191361
  - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf
Sigma Detection Rule: CrashControl CrashDump Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tobias Michalski (Nextron Systems)
Date: 2022-02-24
ATT&CK techniques: T1564, T1112
Log source: windows/registry_set

Description:
Detects disabling the CrashDump per registry (as used by HermeticWiper)

Detection logic:
{
  "selection": {
    "TargetObject|contains": "SYSTEM\\CurrentControlSet\\Control\\CrashControl",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
Sigma Detection Rule: Directory Service Restore Mode(DSRM) Registry Value Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nischal Khadgi
Date: 2024-07-11
ATT&CK techniques: T1556
Log source: windows/registry_set

Description:
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Control\\Lsa\\DsrmAdminLogonBehavior"
  },
  "filter_main_default_value": {
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://adsecurity.org/?p=1785
  - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/
  - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials
Sigma Detection Rule: Uncommon Microsoft Office Trusted Location Added
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-21
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Security\\Trusted Locations\\Location",
    "TargetObject|endswith": "\\Path"
  },
  "filter_exclude_known_paths": {
    "Details|contains": [
      "%APPDATA%\\Microsoft\\Templates",
      "%%APPDATA%%\\Microsoft\\Templates",
      "%APPDATA%\\Microsoft\\Word\\Startup",
      "%%APPDATA%%\\Microsoft\\Word\\Startup",
      ":\\Program Files (x86)\\Microsoft Office\\root\\Templates\\",
      ":\\Program Files\\Microsoft Office (x86)\\Templates",
      ":\\Program Files\\Microsoft Office\\root\\Templates\\",
      ":\\Program Files\\Microsoft Office\\Templates\\"
    ]
  },
  "filter_main_office_click_to_run": {
    "Image|contains": ":\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\",
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "filter_main_office_apps": {
    "Image|contains": [
      ":\\Program Files\\Microsoft Office\\",
      ":\\Program Files (x86)\\Microsoft Office\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_exclude_*"
}

References:
  - Internal Research
  - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
Sigma Detection Rule: Registry Modification to Hidden File Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1137
Log source: windows/registry_set

Description:
Hides the file extension through modification of the registry

Detection logic:
{
  "selection_HideFileExt": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
    "Details": "DWORD (0x00000001)"
  },
  "selection_Hidden": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
    "Details": "DWORD (0x00000002)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd
  - https://unit42.paloaltonetworks.com/ransomware-families/
  - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A
Sigma Detection Rule: Suspicious Execution Of Renamed Sysinternals Tools - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1588.002
Log source: windows/registry_set

Description:
Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Active Directory Explorer",
      "\\Handle",
      "\\LiveKd",
      "\\ProcDump",
      "\\Process Explorer",
      "\\PsExec",
      "\\PsLoggedon",
      "\\PsLoglist",
      "\\PsPasswd",
      "\\PsPing",
      "\\PsService",
      "\\SDelete"
    ],
    "TargetObject|endswith": "\\EulaAccepted"
  },
  "filter": {
    "Image|endswith": [
      "\\ADExplorer.exe",
      "\\ADExplorer64.exe",
      "\\handle.exe",
      "\\handle64.exe",
      "\\livekd.exe",
      "\\livekd64.exe",
      "\\procdump.exe",
      "\\procdump64.exe",
      "\\procexp.exe",
      "\\procexp64.exe",
      "\\PsExec.exe",
      "\\PsExec64.exe",
      "\\PsLoggedon.exe",
      "\\PsLoggedon64.exe",
      "\\psloglist.exe",
      "\\psloglist64.exe",
      "\\pspasswd.exe",
      "\\pspasswd64.exe",
      "\\PsPing.exe",
      "\\PsPing64.exe",
      "\\PsService.exe",
      "\\PsService64.exe",
      "\\sdelete.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - Internal Research
Sigma Detection Rule: Change User Account Associated with the FAX Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-07-17
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect change of the user account associated with the FAX service to avoid the escalation problem.

Detection logic:
{
  "selection": {
    "TargetObject": "HKLM\\System\\CurrentControlSet\\Services\\Fax\\ObjectName"
  },
  "filter": {
    "Details|contains": "NetworkService"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/dottor_morte/status/[PII_REDACTED]70191361
  - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf