deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Register New IFiltre For Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.


Detection logic:
{
  "selection_ext": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Classes\\.",
      "\\PersistentHandler"
    ]
  },
  "selection_clsid": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Classes\\CLSID",
      "\\PersistentAddinsRegistered\\{89BCB740-6119-101A-BCB7-00DD010655AF}"
    ]
  },
  "filter_default_targets": {
    "TargetObject|contains": [
      "\\CLSID\\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\\",
      "\\CLSID\\{4887767F-7ADC-4983-B576-88FB643D6F79}\\",
      "\\CLSID\\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\\",
      "\\CLSID\\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\\",
      "\\CLSID\\{098f2470-bae0-11cd-b579-08002b30bfeb}\\",
      "\\CLSID\\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\\",
      "\\CLSID\\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\\",
      "\\CLSID\\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\\",
      "\\CLSID\\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\\",
      "\\CLSID\\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\\",
      "\\CLSID\\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\\",
      "\\CLSID\\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\\",
      "\\CLSID\\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\\",
      "\\CLSID\\{5e941d80-bf96-11cd-b579-08002b30bfeb}\\",
      "\\CLSID\\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\\",
      "\\CLSID\\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\\",
      "\\CLSID\\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\\",
      "\\CLSID\\{9694E38A-E081-46ac-99A0-8743C909ACB6}\\",
      "\\CLSID\\{98de59a0-d175-11cd-a7bd-00006b827d94}\\",
      "

References:
  - https://persistence-info.github.io/Data/ifilters.html
  - https://twitter.com/0gtweet/status/[PII_REDACTED]00459267
  - https://github.com/gtworek/PSBits/tree/master/IFilter
  - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308
Sigma Detection Rule: Add Debugger Entry To AeDebug For Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\Debugger",
    "Details|endswith": ".dll"
  },
  "filter": {
    "Details": "\"C:\\WINDOWS\\system32\\vsjitdebugger.exe\" -p %ld -e %ld -j 0x%p"
  },
  "condition": "selection and not filter"
}

References:
  - https://persistence-info.github.io/Data/aedebug.html
  - https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
Sigma Detection Rule: Potential Persistence Via Custom Protocol Handler
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-30
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.

Detection logic:
{
  "selection": {
    "TargetObject|startswith": "HKCR\\",
    "Details|startswith": "URL:"
  },
  "filter_main_ms_trusted": {
    "Details|startswith": "URL:ms-"
  },
  "filter_main_generic_locations": {
    "Image|startswith": [
      "C:\\Program Files (x86)",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/
Sigma Detection Rule: New BgInfo.EXE Custom VBScript Registry Configuration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Winternals\\BGInfo\\UserFields\\",
    "Details|startswith": "4"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: ClickOnce Trust Prompt Tampering
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @SerkinValery, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-12
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\MICROSOFT\\.NETFramework\\Security\\TrustManager\\PromptingLevel\\",
    "TargetObject|endswith": [
      "\\Internet",
      "\\LocalIntranet",
      "\\MyComputer",
      "\\TrustedSites",
      "\\UntrustedSites"
    ],
    "Details": "Enabled"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior
Sigma Detection Rule: Hide Schedule Task Via Index Value Tamper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-26
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects when the "index" value of a scheduled task is modified from the registry
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\",
      "Index"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
Sigma Detection Rule: Enable Local Manifest Installation With Winget
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
Log source: windows/registry_set

Description:
Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\AppInstaller\\EnableLocalManifestFiles",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Sigma Detection Rule: Wdigest Enable UseLogonCredential
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-09-12
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "WDigest\\UseLogonCredential",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html
  - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2[PII_REDACTED]1-04ac-b7f3-52aa-9f951c14b649
  - https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials
Sigma Detection Rule: UAC Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: frack113
Date: 2022-01-05
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md
Sigma Detection Rule: Antivirus Filter Driver Disallowed On Dev Drive - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-05
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\FilterManager\\FltmgrDevDriveAllowAntivirusFilter",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]19752955
Sigma Detection Rule: Potential Signing Bypass Via Windows Developer Features - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-12
Log source: windows/registry_set

Description:
Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock",
      "\\Policies\\Microsoft\\Windows\\Appx\\"
    ],
    "TargetObject|endswith": [
      "\\AllowAllTrustedApps",
      "\\AllowDevelopmentWithoutDevLicense"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]09598721
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
Sigma Detection Rule: Potential Persistence Via CHM Helper DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Software\\Microsoft\\HtmlHelp Author\\Location",
      "\\Software\\WOW6432Node\\Microsoft\\HtmlHelp Author\\Location"
    ]
  },
  "condition": "selection"
}

References:
  - https://persistence-info.github.io/Data/htmlhelpauthor.html
  - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
Sigma Detection Rule: Hiding User Account Via SpecialAccounts Registry Key
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2022-07-12
ATT&CK techniques: T1564.002
Log source: windows/registry_set

Description:
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
Sigma Detection Rule: ETW Logging Disabled In .NET Processes - Sysmon Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-05
ATT&CK techniques: T1112, T1685
Log source: windows/registry_set

Description:
Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Detection logic:
{
  "selection_etw_enabled": {
    "TargetObject|endswith": "SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled",
    "Details": "DWORD (0x00000000)"
  },
  "selection_complus": {
    "TargetObject|endswith": [
      "\\COMPlus_ETWEnabled",
      "\\COMPlus_ETWFlags"
    ],
    "Details": [
      0,
      "DWORD (0x00000000)"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]28378368
  - https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr
  - https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables
  - https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38
  - https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39
Sigma Detection Rule: Old TLS1.0/TLS1.1 Protocol Version Enabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-05
Log source: windows/registry_set

Description:
Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\",
      "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\"
    ],
    "TargetObject|endswith": "\\Enabled",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
Sigma Detection Rule: Change Winevt Channel Access Permission Via Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-09-17
ATT&CK techniques: T1685.001
Log source: windows/registry_set

Description:
Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\",
    "TargetObject|endswith": "\\ChannelAccess",
    "Details|contains": [
      "(A;;0x1;;;LA)",
      "(A;;0x1;;;SY)",
      "(A;;0x5;;;BA)"
    ]
  },
  "filter_main_trustedinstaller": {
    "Image": "C:\\Windows\\servicing\\TrustedInstaller.exe"
  },
  "filter_main_tiworker": {
    "Image|startswith": "C:\\Windows\\WinSxS\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/
  - https://learn.microsoft.com/en-us/windows/win32/api/winevt/
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Sigma Detection Rule: Outlook Security Settings Updated - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1137
Log source: windows/registry_set

Description:
Detects changes to the registry values related to outlook security settings

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Office\\",
      "\\Outlook\\Security\\"
    ]
  },
  "filter_main_outlook": {
    "Image|startswith": [
      "C:\\Program Files\\Microsoft Office\\",
      "C:\\Program Files (x86)\\Microsoft Office\\"
    ],
    "Image|endswith": "\\OUTLOOK.EXE"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md
  - https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
Sigma Detection Rule: Disabled Windows Defender Eventlog
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-04
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Windows Defender/Operational\\Enabled",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/WhichbufferArda/status/[PII_REDACTED]80293889/photo/2
Sigma Detection Rule: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-08-02
ATT&CK techniques: T1218
Log source: windows/registry_set

Description:
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]62153472
Sigma Detection Rule: Persistence Via Disk Cleanup Handler - Autorun
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.


Detection logic:
{
  "root": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\"
  },
  "selection_autorun": {
    "TargetObject|contains": "\\Autorun",
    "Details": "DWORD (0x00000001)"
  },
  "selection_pre_after": {
    "TargetObject|contains": [
      "\\CleanupString",
      "\\PreCleanupString"
    ],
    "Details|contains": [
      "cmd",
      "powershell",
      "rundll32",
      "mshta",
      "cscript",
      "wscript",
      "wsl",
      "\\Users\\Public\\",
      "\\Windows\\TEMP\\",
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
    ]
  },
  "condition": "root and 1 of selection_*"
}

References:
  - https://persistence-info.github.io/Data/diskcleanuphandler.html
  - https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
Sigma Detection Rule: Registry Disable System Restore
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-04-04
ATT&CK techniques: T1490
Log source: windows/registry_set

Description:
Detects the modification of the registry to disable a system restore on the computer

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Policies\\Microsoft\\Windows NT\\SystemRestore",
      "\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore"
    ],
    "TargetObject|endswith": [
      "DisableConfig",
      "DisableSR"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
Sigma Detection Rule: PUA - Sysinternals Tools Execution - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1588.002
Log source: windows/registry_set

Description:
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Active Directory Explorer",
      "\\Handle",
      "\\LiveKd",
      "\\Process Explorer",
      "\\ProcDump",
      "\\PsExec",
      "\\PsLoglist",
      "\\PsPasswd",
      "\\SDelete",
      "\\Sysinternals"
    ],
    "TargetObject|endswith": "\\EulaAccepted"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Moti_B/status/[PII_REDACTED]35035392
Sigma Detection Rule: Bypass UAC Using Event Viewer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-05
ATT&CK techniques: T1547.010
Log source: windows/registry_set

Description:
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "_Classes\\mscfile\\shell\\open\\command\\(Default)"
  },
  "filter": {
    "Details|startswith": "%SystemRoot%\\system32\\mmc.exe \"%1\" %"
  },
  "condition": "selection and not filter"
}

References:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd
Sigma Detection Rule: Suspicious Printer Driver Empty Manufacturer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-01
ATT&CK techniques: T1574
Log source: windows/registry_set

Description:
Detects a suspicious printer driver installation with an empty Manufacturer value

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Control\\Print\\Environments\\Windows x64\\Drivers",
      "\\Manufacturer"
    ],
    "Details": "(Empty)"
  },
  "filter_cutepdf": {
    "TargetObject|contains": "\\CutePDF Writer v4.0\\"
  },
  "filter_vnc": {
    "TargetObject|contains": [
      "\\VNC Printer (PS)\\",
      "\\VNC Printer (UD)\\"
    ]
  },
  "filter_pdf24": {
    "TargetObject|contains": "\\Version-3\\PDF24\\"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]73467140