deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Service Binary in Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), frack113
Date: 2022-05-02
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect the creation of a service with a service binary located in a suspicious directory

Detection logic:
{
  "selection_service_start": {
    "TargetObject|startswith": "HKLM\\System\\CurrentControlSet\\Services\\",
    "TargetObject|endswith": "\\Start",
    "Image|contains": [
      "\\Users\\Public\\",
      "\\Perflogs\\",
      "\\ADMIN$\\",
      "\\Temp\\"
    ],
    "Details": [
      "DWORD (0x00000000)",
      "DWORD (0x00000001)",
      "DWORD (0x00000002)"
    ]
  },
  "selection_service_imagepath": {
    "TargetObject|startswith": "HKLM\\System\\CurrentControlSet\\Services\\",
    "TargetObject|endswith": "\\ImagePath",
    "Details|contains": [
      "\\Users\\Public\\",
      "\\Perflogs\\",
      "\\ADMIN$\\",
      "\\Temp\\"
    ]
  },
  "filter_optional_avast": {
    "Image|contains|all": [
      "\\Common Files\\",
      "\\Temp\\"
    ]
  },
  "filter_optional_mbamservice": {
    "TargetObject|endswith": "\\CurrentControlSet\\Services\\MBAMInstallerService\\ImagePath",
    "Details|endswith": "\\AppData\\Local\\Temp\\MBAMInstallerService.exe\"",
    "Image": "C:\\Windows\\system32\\services.exe"
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Python Function Execution Security Warning Disabled In Excel - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale
Date: 2024-08-23
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Office\\",
    "TargetObject|endswith": "\\Excel\\Security\\PythonFunctionWarnings",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f[PII_REDACTED]7
Sigma Detection Rule: Disable Windows Security Center Notifications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect set UseActionCenterExperience to 0 to disable the Windows security center notification

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1112/T1112.md
Sigma Detection Rule: Lsass Full Dump Request Via DumpType Registry Settings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @pbssubhash
Date: 2022-12-08
ATT&CK techniques: T1003.001
Log source: windows/registry_set

Description:
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType",
      "\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\lsass.exe\\DumpType"
    ],
    "Details": "DWORD (0x00000002)"
  },
  "condition": "selection"
}

References:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
Sigma Detection Rule: ETW Logging Disabled For rpcrt4.dll
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-09
ATT&CK techniques: T1112, T1685
Log source: windows/registry_set

Description:
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Windows NT\\Rpc\\ExtErrorInformation",
    "Details": [
      "DWORD (0x00000000)",
      "DWORD (0x00000002)"
    ]
  },
  "condition": "selection"
}

References:
  - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html
Sigma Detection Rule: Enable LM Hash Storage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-15
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes.
By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "System\\CurrentControlSet\\Control\\Lsa\\NoLMHash",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
  - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
Sigma Detection Rule: DHCP Callout DLL Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Dimitrios Slamaris
Date: 2017-05-15
ATT&CK techniques: T1574.001, T1112
Log source: windows/registry_set

Description:
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\Services\\DHCPServer\\Parameters\\CalloutDlls",
      "\\Services\\DHCPServer\\Parameters\\CalloutEnabled"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
Sigma Detection Rule: Modify User Shell Folders Startup Value
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-10-01
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.
Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.


Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"
    ],
    "TargetObject|endswith": [
      "\\Common Startup",
      "\\Startup"
    ]
  },
  "filter_main_details_null": {
    "Details": null
  },
  "filter_main_programdata_startup": {
    "Details|contains": [
      "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
      "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "filter_main_userprofile_startup_1": {
    "Details|contains": [
      "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
      "%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "filter_main_userprofile_startup_2": {
    "Details|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
Sigma Detection Rule: Potential Persistence Via AutodialDLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-10
Log source: windows/registry_set

Description:
Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\WinSock2\\Parameters\\AutodialDLL"
  },
  "condition": "selection"
}

References:
  - https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
  - https://persistence-info.github.io/Data/autodialdll.html
Sigma Detection Rule: Potential Registry Persistence Attempt Via Windows Telemetry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Lednyov Alexey, oscd.community, Sreeman
Date: 2020-10-16
ATT&CK techniques: T1053.005
Log source: windows/registry_set

Description:
Detects potential persistence behavior using the windows telemetry registry key.
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\",
    "TargetObject|endswith": "\\Command",
    "Details|contains": [
      ".bat",
      ".bin",
      ".cmd",
      ".dat",
      ".dll",
      ".exe",
      ".hta",
      ".jar",
      ".js",
      ".msi",
      ".ps",
      ".sh",
      ".vb"
    ]
  },
  "filter_main_generic": {
    "Details|contains": [
      "\\system32\\CompatTelRunner.exe",
      "\\system32\\DeviceCensus.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
Sigma Detection Rule: Scheduled TaskCache Change by Uncommon Program
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Syed Hasan (@syedhasan009)
Date: 2021-06-18
ATT&CK techniques: T1053, T1053.005
Log source: windows/registry_set

Description:
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Detection logic:
{
  "selection": {
    "TargetObject|contains": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\"
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_other": {
    "TargetObject|contains": [
      "Microsoft\\Windows\\UpdateOrchestrator",
      "Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask\\Index",
      "Microsoft\\Windows\\Flighting\\OneSettings\\RefreshCache\\Index"
    ]
  },
  "filter_main_mousocoreworker": {
    "Image|endswith": "C:\\Windows\\System32\\MoUsoCoreWorker.exe"
  },
  "filter_main_services": {
    "Image|endswith": "C:\\Windows\\System32\\services.exe"
  },
  "filter_main_tiworker": {
    "Image|startswith": "C:\\Windows\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "filter_main_svchost": {
    "Image": "C:\\WINDOWS\\system32\\svchost.exe"
  },
  "filter_main_ngen": {
    "Image|startswith": "C:\\Windows\\Microsoft.NET\\Framework",
    "Image|endswith": "\\ngen.exe",
    "TargetObject|contains": [
      "\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B66B135D-DA06-4FC4-95F8-7458E1D10129}",
      "\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN"
    ]
  },
  "filter_main_office": {
    "Image": [
      "C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe",
      "C:\\Program Files (x86)\\Microsoft Office\\root\\Integration\\Int

References:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://labs.f-secure.com/blog/scheduled-task-tampering/
Sigma Detection Rule: Hypervisor Enforced Paging Translation Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-05
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\DisableHypervisorEnforcedPagingTranslation",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/standa_t/status/[PII_REDACTED]78803222
  - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf
Sigma Detection Rule: Scripted Diagnostics Turn Off Check Enabled - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2022-06-15
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Policies\\Microsoft\\Windows\\ScriptedDiagnostics\\TurnOffCheck",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/wdormann/status/[PII_REDACTED]68877057?s=20&t=0lr18OAnmAGoGpma6grLUw
Sigma Detection Rule: Wow6432Node CurrentVersion Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "selection_wow_current_version_base": {
    "TargetObject|contains": "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion"
  },
  "selection_wow_current_version_keys": {
    "TargetObject|contains": [
      "\\ShellServiceObjectDelayLoad",
      "\\Run\\",
      "\\RunOnce\\",
      "\\RunOnceEx\\",
      "\\RunServices\\",
      "\\RunServicesOnce\\",
      "\\Explorer\\ShellServiceObjects",
      "\\Explorer\\ShellIconOverlayIdentifiers",
      "\\Explorer\\ShellExecuteHooks",
      "\\Explorer\\SharedTaskScheduler",
      "\\Explorer\\Browser Helper Objects"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_ms_win_desktop_runtime": {
    "Details|startswith": "\"C:\\ProgramData\\Package Cache\\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\\windowsdesktop-runtime-"
  },
  "filter_main_vcredist": {
    "Image|endswith": "\\VC_redist.x64.exe",
    "Details|endswith": "}\\VC_redist.x64.exe\" /burn.runonce"
  },
  "filter_main_upgrades": {
    "Image|startswith": [
      "C:\\ProgramData\\Package Cache",
      "C:\\Windows\\Temp\\"
    ],
    "Image|contains": [
      "\\winsdksetup.exe",
      "\\windowsdesktop-runtime-",
      "\\AspNetCoreSharedFrameworkBundle-"
    ],
    "Details|endswith": " /burn.runonce"
  },
  "filter_main_uninstallers": {
    "Image|startswith": "C:\\Windows\\Installer\\MSI",
    "TargetObject|contains": "\\Explorer\\Browser Helper Objects"
  },
  "filter_main_msiexec

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/
Sigma Detection Rule: Potential Persistence Via Logon Scripts - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tom Ueltschi (@c_APT_ure)
Date: 2019-01-12
ATT&CK techniques: T1037.001
Log source: windows/registry_set

Description:
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Detection logic:
{
  "selection": {
    "TargetObject|contains": "UserInitMprLogonScript"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md
Sigma Detection Rule: Suspicious Keyboard Layout Load
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-12
ATT&CK techniques: T1588.002
Log source: windows/registry_set

Description:
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only

Detection logic:
{
  "selection_registry": {
    "TargetObject|contains": [
      "\\Keyboard Layout\\Preload\\",
      "\\Keyboard Layout\\Substitutes\\"
    ],
    "Details|contains": [
      "00000429",
      "00050429",
      "0000042a"
    ]
  },
  "condition": "selection_registry"
}

References:
  - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
  - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
Sigma Detection Rule: ServiceDll Hijack
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-04
ATT&CK techniques: T1543.003
Log source: windows/registry_set

Description:
Detects changes to the "ServiceDLL" value related to a service in the registry.
This is often used as a method of persistence.


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\System\\",
      "ControlSet",
      "\\Services\\"
    ],
    "TargetObject|endswith": "\\Parameters\\ServiceDll"
  },
  "filter_main_printextensionmanger": {
    "Details": "C:\\Windows\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll"
  },
  "filter_main_domain_controller": {
    "Image": "C:\\Windows\\system32\\lsass.exe",
    "TargetObject|endswith": "\\Services\\NTDS\\Parameters\\ServiceDll",
    "Details": "%%systemroot%%\\system32\\ntdsa.dll"
  },
  "filter_main_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe"
  },
  "filter_optional_safetica": {
    "Image|endswith": "\\regsvr32.exe",
    "Details": "C:\\Windows\\System32\\STAgent.dll"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time
  - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
Sigma Detection Rule: Potential Persistence Via DLLPathOverride
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

Detection logic:
{
  "selection_root": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\Control\\ContentIndex\\Language\\"
  },
  "selection_values": {
    "TargetObject|contains": [
      "\\StemmerDLLPathOverride",
      "\\WBDLLPathOverride",
      "\\StemmerClass",
      "\\WBreakerClass"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://persistence-info.github.io/Data/naturallanguage6.html
  - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
Sigma Detection Rule: WFP Filter Added via Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Frack113
Date: 2025-10-23
ATT&CK techniques: T1685, T1569.002
Log source: windows/registry_set

Description:
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\BFE\\Parameters\\Policy\\Persistent\\Filter\\"
  },
  "filter_main_svchost": {
    "Image": [
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\SysWOW64\\svchost.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c
  - https://www.huntress.com/blog/silencing-the-edr-silencers
  - https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
Sigma Detection Rule: Potential SentinelOne Shell Context Menu Scan Command Tampering
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-03-06
Log source: windows/registry_set

Description:
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\shell\\SentinelOneScan\\command\\"
  },
  "filter_main_sentinelone_default_scan_binary": {
    "Details|startswith": [
      "C:\\Program Files\\SentinelOne\\Sentinel Agent",
      "C:\\Program Files (x86)\\SentinelOne\\Sentinel Agent"
    ],
    "Details|contains": "\\SentinelScanFromContextMenu.exe"
  },
  "filter_main_sentinelone_binary": {
    "Image|endswith": [
      "C:\\Program Files\\SentinelOne\\",
      "C:\\Program Files (x86)\\SentinelOne\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://mrd0x.com/sentinelone-persistence-via-menu-context/
Sigma Detection Rule: Potential Persistence Via LSA Extensions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass.
The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\Control\\LsaExtensionConfig\\LsaSrv\\Extensions"
  },
  "condition": "selection"
}

References:
  - https://persistence-info.github.io/Data/lsaaextension.html
  - https://twitter.com/0gtweet/status/[PII_REDACTED]85019906