deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Defender Threat Severity Default Action Modified
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson (Huntress)
Date: 2025-07-11
ATT&CK techniques: T1685
Log source: windows/registry_event

Description:
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,
allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows Defender\\Threats\\ThreatSeverityDefaultAction\\",
    "TargetObject|endswith": [
      "\\1",
      "\\2",
      "\\4",
      "\\5"
    ],
    "Details": [
      "DWORD (0x00000006)",
      "DWORD (0x00000009)"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction
  - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
  - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
Sigma Detection Rule: HybridConnectionManager Service Installation - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
ATT&CK techniques: T1608
Log source: windows/registry_event

Description:
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

Detection logic:
{
  "selection1": {
    "TargetObject|contains": "\\Services\\HybridConnectionManager"
  },
  "selection2": {
    "EventType": "SetValue",
    "Details|contains": "Microsoft.HybridConnectionManager.Listener.exe"
  },
  "condition": "selection1 or selection2"
}

References:
  - https://twitter.com/Cyb3rWard0g/status/[PII_REDACTED]69286662
Sigma Detection Rule: NetNTLM Downgrade Attack - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
Date: 2018-03-20
ATT&CK techniques: T1685, T1112
Log source: windows/registry_event

Description:
Detects NetNTLM downgrade attack

Detection logic:
{
  "selection_regkey": {
    "TargetObject|contains|all": [
      "SYSTEM\\",
      "ControlSet",
      "\\Control\\Lsa"
    ]
  },
  "selection_value_lmcompatibilitylevel": {
    "TargetObject|endswith": "\\lmcompatibilitylevel",
    "Details": [
      "DWORD (0x00000000)",
      "DWORD (0x00000001)",
      "DWORD (0x00000002)"
    ]
  },
  "selection_value_ntlmminclientsec": {
    "TargetObject|endswith": "\\NtlmMinClientSec",
    "Details": [
      "DWORD (0x00000000)",
      "DWORD (0x00000010)",
      "DWORD (0x00000020)",
      "DWORD (0x00000030)"
    ]
  },
  "selection_value_restrictsendingntlmtraffic": {
    "TargetObject|endswith": "\\RestrictSendingNTLMTraffic"
  },
  "condition": "selection_regkey and 1 of selection_value_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
  - https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers
Sigma Detection Rule: Shell Open Registry Keys Manipulation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002, T1546.001
Log source: windows/registry_event

Description:
Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Detection logic:
{
  "selection1": {
    "EventType": "SetValue",
    "TargetObject|endswith": "Classes\\ms-settings\\shell\\open\\command\\SymbolicLinkValue",
    "Details|contains": "\\Software\\Classes\\{"
  },
  "selection2": {
    "TargetObject|endswith": "Classes\\ms-settings\\shell\\open\\command\\DelegateExecute"
  },
  "selection3": {
    "EventType": "SetValue",
    "TargetObject|endswith": [
      "Classes\\ms-settings\\shell\\open\\command\\(Default)",
      "Classes\\exefile\\shell\\open\\command\\(Default)"
    ]
  },
  "filter_sel3": {
    "Details": "(Empty)"
  },
  "condition": "selection1 or selection2 or (selection3 and not filter_sel3)"
}

References:
  - https://github.com/hfiref0x/UACME
  - https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
  - https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass
  - https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]
Sigma Detection Rule: Sticky Key Like Backdoor Usage - Registry
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
Date: 2018-03-15
ATT&CK techniques: T1546.008
Log source: windows/registry_event

Description:
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Detection logic:
{
  "selection_registry": {
    "TargetObject|endswith": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\osk.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Narrator.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DisplaySwitch.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atbroker.exe\\Debugger",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\HelpPane.exe\\Debugger"
    ]
  },
  "condition": "selection_registry"
}

References:
  - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
Sigma Detection Rule: DLL Load via LSASS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-16
ATT&CK techniques: T1547.008
Log source: windows/registry_event

Description:
Detects a method to load DLL via LSASS process using an undocumented Registry key

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt",
      "\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt"
    ]
  },
  "filter_domain_controller": {
    "Image": "C:\\Windows\\system32\\lsass.exe",
    "Details": [
      "%%systemroot%%\\system32\\ntdsa.dll",
      "%%systemroot%%\\system32\\lsadb.dll"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://blog.xpnsec.com/exploring-mimikatz-part-1/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]89427200
Sigma Detection Rule: Potential Credential Dumping Via LSASS SilentProcessExit Technique
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-02-26
ATT&CK techniques: T1003.001
Log source: windows/registry_event

Description:
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe"
  },
  "condition": "selection"
}

References:
  - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
  - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
Sigma Detection Rule: Potential Qakbot Registry Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Hieu Tran
Date: 2023-03-13
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\firm\\soft\\Name"
  },
  "condition": "selection"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: New DLL Added to AppCertDlls Registry Key
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1546.009
Log source: windows/registry_event

Description:
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.


Detection logic:
{
  "selection": [
    {
      "TargetObject": "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls"
    },
    {
      "NewName": "HKLM\\SYSTEM\\CurentControlSet\\Control\\Session Manager\\AppCertDlls"
    }
  ],
  "condition": "selection"
}

References:
  - http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
  - https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
Sigma Detection Rule: Disable Security Events Logging Adding Reg Key MiniNt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1685.001, T1112
Log source: windows/registry_event

Description:
Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

Detection logic:
{
  "selection": [
    {
      "TargetObject": "HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt",
      "EventType": "CreateKey"
    },
    {
      "NewName": "HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt"
    }
  ],
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]55226112
  - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
Sigma Detection Rule: Suspicious Run Key from Download
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)
Date: 2019-10-01
ATT&CK techniques: T1547.001
Log source: windows/registry_event

Description:
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Detection logic:
{
  "selection": {
    "Image|contains": [
      "\\AppData\\Local\\Packages\\Microsoft.Outlook_",
      "\\AppData\\Local\\Microsoft\\Olk\\Attachments\\",
      "\\Downloads\\",
      "\\Temporary Internet Files\\Content.Outlook\\",
      "\\Local Settings\\Temporary Internet Files\\"
    ],
    "TargetObject|contains": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    ]
  },
  "condition": "selection"
}

References:
  - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: RedMimicry Winnti Playbook Registry Manipulation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Alexander Rausch
Date: 2020-06-24
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects actions caused by the RedMimicry Winnti playbook

Detection logic:
{
  "selection": {
    "TargetObject|contains": "HKLM\\SOFTWARE\\Microsoft\\HTMLHelp\\data"
  },
  "condition": "selection"
}

References:
  - https://redmimicry.com
Sigma Detection Rule: Registry Tampering by Potentially Suspicious Processes
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
ATT&CK techniques: T1112, T1059.005
Log source: windows/registry_event

Description:
Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\mshta.exe",
      "\\wscript.exe",
      "\\cscript.exe"
    ]
  },
  "filter_main_binary_data": {
    "Details": "Binary Data"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_wscript_legit_1": {
    "Image|endswith": "\\wscript.exe",
    "TargetObject|contains": [
      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data\\",
      "\\Services\\bam\\State\\UserSettings\\S-1-",
      "Software\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe\\",
      "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\"
    ]
  },
  "filter_main_wscript_legit_2": {
    "Image|endswith": "\\wscript.exe",
    "TargetObject|contains": "\\wscript.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
  - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity[PII_REDACTED]182051843-TE00/
Sigma Detection Rule: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-11-03
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\WBEM\\CIMOM\\AllowAnonymousCallback",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista
Sigma Detection Rule: Esentutl Volume Shadow Copy Service Keys
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-20
ATT&CK techniques: T1003.002
Log source: windows/registry_event

Description:
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "System\\CurrentControlSet\\Services\\VSS",
    "Image|endswith": "esentutl.exe"
  },
  "filter": {
    "TargetObject|contains": "System\\CurrentControlSet\\Services\\VSS\\Start"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
Sigma Detection Rule: Narrator's Feedback-Hub Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Dmitriy Lifanov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_event

Description:
Detects abusing Windows 10 Narrator's Feedback-Hub

Detection logic:
{
  "selection1": {
    "EventType": "DeleteValue",
    "TargetObject|endswith": "\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\Shell\\open\\command\\DelegateExecute"
  },
  "selection2": {
    "TargetObject|endswith": "\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\Shell\\open\\command\\(Default)"
  },
  "condition": "1 of selection*"
}

References:
  - https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
Sigma Detection Rule: Office Application Startup - Office Test
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: omkar72
Date: 2020-10-25
ATT&CK techniques: T1137.002
Log source: windows/registry_event

Description:
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Microsoft\\Office test\\Special\\Perf"
  },
  "condition": "selection"
}

References:
  - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/
Sigma Detection Rule: Removal Of Index Value to Hide Schedule Task - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-26
ATT&CK techniques: T1685
Log source: windows/registry_delete

Description:
Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\",
      "Index"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
Sigma Detection Rule: RunMRU Registry Key Deletion - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-25
ATT&CK techniques: T1070.003
Log source: windows/registry_delete

Description:
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
  },
  "condition": "selection"
}

References:
  - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
Sigma Detection Rule: Removal of Potential COM Hijacking Registry Keys
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1112
Log source: windows/registry_delete

Description:
Detects any deletion of entries in ".*\shell\open\command" registry keys.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\shell\\open\\command"
  },
  "filter_main_explorer": {
    "Image|endswith": "C:\\Windows\\explorer.exe"
  },
  "filter_main_svchost": {
    "Image": "C:\\Windows\\system32\\svchost.exe"
  },
  "filter_main_msiexec": {
    "Image": [
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe"
    ]
  },
  "filter_main_generic_prorams": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_openwith": {
    "Image": "C:\\Windows\\System32\\OpenWith.exe"
  },
  "filter_optional_dropbox": {
    "Image|endswith": "\\Dropbox.exe",
    "TargetObject|contains": "\\Dropbox."
  },
  "filter_optional_wireshark": {
    "Image|endswith": "\\AppData\\Local\\Temp\\Wireshark_uninstaller.exe",
    "TargetObject|contains": "\\wireshark-capture-file\\"
  },
  "filter_optional_peazip": {
    "Image|contains": "peazip",
    "TargetObject|contains": "\\PeaZip."
  },
  "filter_optional_everything": {
    "Image|endswith": "\\Everything.exe",
    "TargetObject|contains": "\\Everything."
  },
  "filter_optional_uninstallers": {
    "Image|startswith": "C:\\Windows\\Installer\\MSI"
  },
  "filter_optional_java": {
    "Image|startswith": "C:\\Program Files (x86)\\Java\\",
    "Image|endswith": "\\installer.exe",
    "TargetObject|contains": "\\Classes\\WOW6432Node\\CLSID\\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}"
  },
  "filter_optional_edgeupdate": {
    "Image|co

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/7
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md
  - https://learn.microsoft.com/en-us/windows/win32/shell/launch
  - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
  - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
Sigma Detection Rule: Windows Credential Guard Related Registry Value Deleted - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-26
ATT&CK techniques: T1685
Log source: windows/registry_delete

Description:
Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\DeviceGuard\\EnableVirtualizationBasedSecurity",
      "\\DeviceGuard\\LsaCfgFlags",
      "\\DeviceGuard\\RequirePlatformSecurityFeatures",
      "\\Lsa\\LsaCfgFlags"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure
Sigma Detection Rule: Removal Of SD Value to Hide Schedule Task - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sittikorn S
Date: 2022-04-15
ATT&CK techniques: T1685
Log source: windows/registry_delete

Description:
Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\",
      "SD"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/