deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Folder Removed From Exploit Guard ProtectedFolders List - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1685
Log source: windows/registry_delete

Description:
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

Detection logic:
{
  "selection": {
    "EventType": "DeleteValue",
    "TargetObject|contains": "SOFTWARE\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\ProtectedFolders"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/
Sigma Detection Rule: Terminal Server Client Connection History Cleared - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-10-19
ATT&CK techniques: T1070, T1112
Log source: windows/registry_delete

Description:
Detects the deletion of registry keys containing the MSTSC connection history

Detection logic:
{
  "selection1": {
    "EventType": "DeleteValue",
    "TargetObject|contains": "\\Microsoft\\Terminal Server Client\\Default\\MRU"
  },
  "selection2": {
    "EventType": "DeleteKey",
    "TargetObject|contains": "\\Microsoft\\Terminal Server Client\\Servers\\"
  },
  "condition": "1 of selection*"
}

References:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
  - http://woshub.com/how-to-clear-rdp-connections-history/
  - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
Sigma Detection Rule: Removal Of AMSI Provider Registry Keys
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-06-07
ATT&CK techniques: T1685
Log source: windows/registry_delete

Description:
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "{2781761E-28E0-4109-99FE-B9D127C57AFE}",
      "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}"
    ]
  },
  "filter_main_defender": {
    "Image|startswith": [
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Program Files\\Windows Defender\\",
      "C:\\Program Files (x86)\\Windows Defender\\"
    ],
    "Image|endswith": "\\MsMpEng.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://seclists.org/fulldisclosure/2020/Mar/45
Sigma Detection Rule: Delete Defender Scan ShellEx Context Menu Registry Key
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Matt Anderson (Huntress)
Date: 2025-07-11
Log source: windows/registry_delete

Description:
Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "shellex\\ContextMenuHandlers\\EPP"
  },
  "filter_main_defender": {
    "Image|startswith": [
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Program Files\\Windows Defender\\",
      "C:\\Program Files (x86)\\Windows Defender\\"
    ],
    "Image|endswith": "\\MsMpEng.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
  - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
Sigma Detection Rule: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sajid Nawaz Khan
Date: 2024-06-02
ATT&CK techniques: T1113
Log source: windows/registry_delete

Description:
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.


Detection logic:
{
  "selection": {
    "EventType": "DeleteValue",
    "TargetObject|endswith": "\\Microsoft\\Windows\\WindowsAI\\DisableAIDataAnalysis"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
  - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
Sigma Detection Rule: Windows Defender Service Disabled - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali
Date: 2022-08-01
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects when an attacker or tool disables the  Windows Defender service (WinDefend) via the registry

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Services\\WinDefend\\Start",
    "Details": "DWORD (0x00000004)"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://gist.github.com/anadr/7465a9fde63d[PII_REDACTED]9f14c21105
Sigma Detection Rule: AMSI Disabled via Registry Modification
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-25
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.
Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.
Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
Sigma Detection Rule: Potential Persistence Via Visual Studio Tools for Office
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bhabesh Raj
Date: 2021-01-10
ATT&CK techniques: T1137.006
Log source: windows/registry_set

Description:
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Software\\Microsoft\\Office\\Outlook\\Addins\\",
      "\\Software\\Microsoft\\Office\\Word\\Addins\\",
      "\\Software\\Microsoft\\Office\\Excel\\Addins\\",
      "\\Software\\Microsoft\\Office\\Powerpoint\\Addins\\",
      "\\Software\\Microsoft\\VSTO\\Security\\Inclusion\\"
    ]
  },
  "filter_main_system": {
    "Image": [
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe",
      "C:\\Windows\\System32\\regsvr32.exe",
      "C:\\Windows\\SysWOW64\\regsvr32.exe"
    ]
  },
  "filter_main_office_click_to_run": {
    "Image|startswith": [
      "C:\\Program Files\\Common Files (x86)\\Microsoft Shared\\ClickToRun\\",
      "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\"
    ],
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "filter_main_integrator": {
    "Image": [
      "C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe",
      "C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe"
    ]
  },
  "filter_main_office_apps": {
    "Image|startswith": [
      "C:\\Program Files\\Microsoft Office\\OFFICE",
      "C:\\Program Files (x86)\\Microsoft Office\\OFFICE",
      "C:\\Program Files\\Microsoft Office\\Root\\OFFICE",
      "C:\\Program Files (x86)\\Microsoft Office\\Root\\OFFICE",
      "C:\\PROGRA~2\\MICROS~2\\Office"
    ],
    "Image|endswith": [
      "\\excel.exe",
      "\\Integrator.exe",
      "\\OneNot

References:
  - https://twitter.com/_vivami/status/[PII_REDACTED]43355138
  - https://vanmieghem.io/stealth-outlook-persistence/
Sigma Detection Rule: UAC Bypass Using Windows Media Player - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store\\C:\\Program Files\\Windows Media Player\\osk.exe",
    "Details": "Binary Data"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Potential Persistence Via Scrobj.dll COM Hijacking
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-20
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "InprocServer32\\(Default)",
    "Details": "C:\\WINDOWS\\system32\\scrobj.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1546.015/T1546.015.md
Sigma Detection Rule: PowerShell as a Service in Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1569.002
Log source: windows/registry_set

Description:
Detects that a powershell code is written to the registry as a service.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\",
    "TargetObject|endswith": "\\ImagePath",
    "Details|contains": [
      "powershell",
      "pwsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Potential Attachment Manager Settings Attachments Tamper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
Log source: windows/registry_set

Description:
Detects tampering with attachment manager settings policies attachments (See reference for more information)

Detection logic:
{
  "selection_main": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments\\"
  },
  "selection_value_hide_zone_info": {
    "TargetObject|endswith": "\\HideZoneInfoOnProperties",
    "Details": "DWORD (0x00000001)"
  },
  "selection_value_save_zone_info": {
    "TargetObject|endswith": "\\SaveZoneInformation",
    "Details": "DWORD (0x00000002)"
  },
  "selection_value_scan_with_av": {
    "TargetObject|endswith": "\\ScanWithAntiVirus",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection_main and 1 of selection_value_*"
}

References:
  - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c[PII_REDACTED]d1264f692c7664c02c68465
Sigma Detection Rule: Suspicious PowerShell In Registry Run Keys
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-03-17
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects potential PowerShell commands or code within registry run keys

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    ],
    "Details|contains": [
      "powershell",
      "pwsh ",
      "FromBase64String",
      ".DownloadFile(",
      ".DownloadString(",
      " -w hidden ",
      " -w 1 ",
      "-windowstyle hidden",
      "-window hidden",
      " -nop ",
      " -encodedcommand ",
      "-ExecutionPolicy Bypass",
      "Invoke-Expression",
      "IEX (",
      "Invoke-Command",
      "ICM -",
      "Invoke-WebRequest",
      "IWR ",
      "Invoke-RestMethod",
      "IRM ",
      " -noni ",
      " -noninteractive "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry
  - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Registry Hide Function from User
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-18
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)

Detection logic:
{
  "selection_set_1": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideClock",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideSCAHealth",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideSCANetwork",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideSCAPower",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideSCAVolume"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "selection_set_0": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "1 of selection_set_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
Sigma Detection Rule: New Netsh Helper DLL Registered From A Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-28
ATT&CK techniques: T1546.007
Log source: windows/registry_set

Description:
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper


Detection logic:
{
  "selection_target": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\NetSh"
  },
  "selection_folders_1": {
    "Details|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\Temporary Internet"
    ]
  },
  "selection_folders_2": [
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "condition": "selection_target and 1 of selection_folders_*"
}

References:
  - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
  - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
Sigma Detection Rule: Potential Persistence Via Shim Database In Uncommon Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-01
ATT&CK techniques: T1546.011
Log source: windows/registry_set

Description:
Detects the installation of a new shim database where the file is located in a non-default location

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\",
      "\\DatabasePath"
    ]
  },
  "filter_main_known_locations": {
    "Details|contains": ":\\Windows\\AppPatch\\Custom"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
  - https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
Sigma Detection Rule: Potential Credential Dumping Attempt Using New NetworkProvider - REG
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-23
ATT&CK techniques: T1003
Log source: windows/registry_set

Description:
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\System\\CurrentControlSet\\Services\\",
      "\\NetworkProvider"
    ]
  },
  "filter": {
    "TargetObject|contains": [
      "\\System\\CurrentControlSet\\Services\\WebClient\\NetworkProvider",
      "\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider",
      "\\System\\CurrentControlSet\\Services\\RDPNP\\NetworkProvider"
    ]
  },
  "filter_valid_procs": {
    "Image": "C:\\Windows\\System32\\poqexec.exe"
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
  - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
Sigma Detection Rule: UAC Bypass via Event Viewer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-19
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects UAC bypass method using Windows event viewer

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\mscfile\\shell\\open\\command"
  },
  "condition": "selection"
}

References:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
Sigma Detection Rule: Potential PSFactoryBuffer COM Hijacking
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
Date: 2023-06-07
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\CLSID\\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\\InProcServer32\\(Default)"
  },
  "filter_main": {
    "Details": [
      "%windir%\\System32\\ActXPrxy.dll",
      "C:\\Windows\\System32\\ActXPrxy.dll"
    ]
  },
  "condition": "selection and not filter_main"
}

References:
  - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
  - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
  - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
  - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
Sigma Detection Rule: Add Debugger Entry To Hangs Key For Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\Debugger"
  },
  "condition": "selection"
}

References:
  - https://persistence-info.github.io/Data/wer_debugger.html
  - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
Sigma Detection Rule: UAC Notification Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-05-10
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value.
UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users.
When "UACDisableNotify" is set to 1, UAC prompts are suppressed.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Security Center\\UACDisableNotify",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md
  - https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/
Sigma Detection Rule: Potential Ransomware Activity Using LegalNotice Message
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-12-11
ATT&CK techniques: T1491.001
Log source: windows/registry_set

Description:
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoticeCaption",
      "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoticeText"
    ],
    "Details|contains": [
      "encrypted",
      "Unlock-Password",
      "paying"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md