deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Winlogon Notify Key Logon Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1547.004
Log source: windows/registry_set

Description:
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\logon",
    "Details|endswith": ".dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell
Sigma Detection Rule: Potential Persistence Via TypedPaths
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-22
Log source: windows/registry_set

Description:
Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\\"
  },
  "filter": {
    "Image": [
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\SysWOW64\\explorer.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/dez_/status/[PII_REDACTED]50257154
  - https://forensafe.com/blogs/typedpaths.html
Sigma Detection Rule: Security Event Logging Disabled via MiniNt Registry Key - Registry Set
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-09
ATT&CK techniques: T1685.001, T1112
Log source: windows/registry_set

Description:
Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.
Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.
Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.


Detection logic:
{
  "selection": {
    "TargetObject": "HKLM\\System\\CurrentControlSet\\Control\\MiniNt\\(Default)"
  },
  "condition": "selection"
}

References:
  - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
Sigma Detection Rule: New File Association Using Exefile
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2021-11-19
Log source: windows/registry_set

Description:
Detects the abuse of the exefile handler in new file association. Used for bypass of security products.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Classes\\.",
    "Details": "exefile"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]14623491
Sigma Detection Rule: Potential CobaltStrike Service Installations - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Wojciech Lesicki
Date: 2021-06-29
ATT&CK techniques: T1021.002, T1543.003, T1569.002
Log source: windows/registry_set

Description:
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.


Detection logic:
{
  "selection_key": [
    {
      "TargetObject|contains": "\\System\\CurrentControlSet\\Services"
    },
    {
      "TargetObject|contains|all": [
        "\\System\\ControlSet",
        "\\Services"
      ]
    }
  ],
  "selection_details": [
    {
      "Details|contains|all": [
        "ADMIN$",
        ".exe"
      ]
    },
    {
      "Details|contains|all": [
        "%COMSPEC%",
        "start",
        "powershell"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
Sigma Detection Rule: Disable PUA Protection on Windows Defender
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-04
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects disabling Windows Defender PUA protection

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Policies\\Microsoft\\Windows Defender\\PUAProtection",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
Sigma Detection Rule: Modification of IE Registry Settings
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence

Detection logic:
{
  "selection_domains": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
  },
  "filter_main_dword": {
    "Details|startswith": "DWORD"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_office": {
    "Details": [
      "Cookie:",
      "Visited:",
      "(Empty)"
    ]
  },
  "filter_main_path": {
    "TargetObject|contains": [
      "\\Cache",
      "\\ZoneMap",
      "\\WpadDecision"
    ]
  },
  "filter_main_binary": {
    "Details": "Binary Data"
  },
  "filter_optional_accepted_documents": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Accepted Documents"
  },
  "condition": "selection_domains and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-5---javascript-in-registry
Sigma Detection Rule: FileFix - Command Evidence in TypedPaths
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-05
ATT&CK techniques: T1204.004
Log source: windows/registry_set

Description:
Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.


Detection logic:
{
  "selection_base": {
    "TargetObject|endswith": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\\url1",
    "Details|contains|all": [
      "#",
      "http"
    ]
  },
  "selection_cmd": [
    {
      "Details|contains": [
        "account",
        "anti-bot",
        "botcheck",
        "captcha",
        "challenge",
        "confirmation",
        "fraud",
        "human",
        "identification",
        "identificator",
        "identity",
        "robot",
        "validation",
        "verification",
        "verify"
      ]
    },
    {
      "Details|contains": [
        "%comspec%",
        "bitsadmin",
        "certutil",
        "cmd",
        "cscript",
        "curl",
        "finger",
        "mshta",
        "powershell",
        "pwsh",
        "regsvr32",
        "rundll32",
        "schtasks",
        "wget",
        "wscript"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://x.com/russianpanda9xx/status/[PII_REDACTED]59506029
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
Sigma Detection Rule: Suspicious Space Characters in RunMRU Registry Path - ClickFix
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-04
ATT&CK techniques: T1204.004, T1027.010
Log source: windows/registry_set

Description:
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.


Detection logic:
{
  "selection_key": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\",
    "Details|contains": "#"
  },
  "selection_space_variation": {
    "Details|contains": [
      "\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000",
      "\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001",
      "\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002",
      "\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003",
      "\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004",
      "\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005",
      "\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006",
      "\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007",
      "\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008",
      "\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009",
      "\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a",
      "\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0",
      "            "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://github.com/JohnHammond/recaptcha-phish
Sigma Detection Rule: Sysmon Driver Altitude Change
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: B.Talebi
Date: 2022-07-28
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes in Sysmon driver altitude value.
If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\",
    "TargetObject|endswith": "\\Instances\\Sysmon Instance\\Altitude"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
  - https://youtu.be/zSihR3lTf7g
Sigma Detection Rule: Driver Added To Disallowed Images In HVCI - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe)
Date: 2023-12-05
Log source: windows/registry_set

Description:
Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Control\\CI\\",
      "\\HVCIDisallowedImages"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf
  - https://x.com/yarden_shafir/status/[PII_REDACTED]75324787
Sigma Detection Rule: Disable Exploit Guard Network Protection on Windows Defender
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-04
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects disabling Windows Defender Exploit Guard Network Protection

Detection logic:
{
  "selection": {
    "TargetObject|contains": "SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\App and Browser protection\\DisallowExploitProtectionOverride",
    "Details": "DWORD (00000001)"
  },
  "condition": "selection"
}

References:
  - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
Sigma Detection Rule: RestrictedAdminMode Registry Value Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-01-13
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md
  - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx
Sigma Detection Rule: Periodic Backup For System Registry Hives Enabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-01
ATT&CK techniques: T1113
Log source: windows/registry_set

Description:
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups.
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Control\\Session Manager\\Configuration Manager\\EnablePeriodicBackup",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
Sigma Detection Rule: Disable Microsoft Defender Firewall via Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-09
ATT&CK techniques: T1686.003
Log source: windows/registry_set

Description:
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\",
    "TargetObject|endswith": "\\EnableFirewall",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry
Sigma Detection Rule: Suspicious Path In Keyboard Layout IME File Registry Value
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-11-21
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.


Detection logic:
{
  "selection_registry": {
    "TargetObject|contains|all": [
      "\\Control\\Keyboard Layouts\\",
      "Ime File"
    ]
  },
  "selection_folders_1": {
    "Details|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Temporary Internet"
    ]
  },
  "selection_folders_2": [
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "Details|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    }
  ],
  "condition": "selection_registry and 1 of selection_folders_*"
}

References:
  - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
Sigma Detection Rule: Common Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows CE Services\\AutoStart",
      "\\Software\\Wow6432Node\\Microsoft\\Command Processor\\Autorun",
      "\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components",
      "\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect",
      "\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect",
      "\\SYSTEM\\Setup\\CmdLine",
      "\\Software\\Microsoft\\Ctf\\LangBarAddin",
      "\\Software\\Microsoft\\Command Processor\\Autorun",
      "\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components",
      "\\SOFTWARE\\Classes\\Protocols\\Handler",
      "\\SOFTWARE\\Classes\\Protocols\\Filter",
      "\\SOFTWARE\\Classes\\Htmlfile\\Shell\\Open\\Command\\(Default)",
      "\\Environment\\UserInitMprLogonScript",
      "\\SOFTWARE\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\Scrnsave.exe",
      "\\Software\\Microsoft\\Internet Explorer\\UrlSearchHooks",
      "\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\Components",
      "\\Software\\Classes\\Clsid\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Inprocserver32",
      "\\Control Panel\\Desktop\\Scrnsave.exe"
    ]
  },
  "filter_main_empty": {
    "Details": "(Empty)"
  },
  "filter_main_null": {
    "Details": null
  },
  "filter_main_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe"
  },
  "filter_optional_msoffice": [
    {
      "TargetObject|contains": [
        "\\Office

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
  - https://persistence-info.github.io/Data/userinitmprlogonscript.html
Sigma Detection Rule: WinSock2 Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "winsock_parameters_base": {
    "TargetObject|contains": "\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters"
  },
  "winsock_parameters": {
    "TargetObject|contains": [
      "\\Protocol_Catalog9\\Catalog_Entries",
      "\\NameSpace_Catalog5\\Catalog_Entries"
    ]
  },
  "filter": [
    {
      "Details": "(Empty)"
    },
    {
      "Image": "C:\\Windows\\System32\\MsiExec.exe"
    },
    {
      "Image": "C:\\Windows\\syswow64\\MsiExec.exe"
    }
  ],
  "condition": "winsock_parameters_base and winsock_parameters and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: ScreenSaver Registry Key Set
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
Date: 2022-05-04
ATT&CK techniques: T1218.011
Log source: windows/registry_set

Description:
Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe"
  },
  "registry": {
    "TargetObject|contains": "\\Control Panel\\Desktop\\SCRNSAVE.EXE",
    "Details|endswith": ".scr"
  },
  "filter": {
    "Details|contains": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and registry and not filter"
}

References:
  - https://twitter.com/VakninHai/status/[PII_REDACTED]84547329
  - https://twitter.com/pabraeken/status/[PII_REDACTED]60695297
  - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files
Sigma Detection Rule: COM Hijacking via TreatAs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-28
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "TreatAs\\(Default)"
  },
  "filter_office": {
    "Image|startswith": "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\",
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "filter_office2": {
    "Image": [
      "C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe",
      "C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe"
    ]
  },
  "filter_svchost": {
    "Image": "C:\\Windows\\system32\\svchost.exe"
  },
  "filter_misexec": {
    "Image": [
      "C:\\Windows\\system32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1546.015/T1546.015.md
  - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
Sigma Detection Rule: Disable Administrative Share Creation at Startup
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1070.005
Log source: windows/registry_set

Description:
Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\LanmanServer\\Parameters\\",
    "TargetObject|endswith": [
      "\\AutoShareWks",
      "\\AutoShareServer"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup
Sigma Detection Rule: Potential Persistence Via Mpnotify
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker register a new SIP provider for persistence and defense evasion

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\mpnotify"
  },
  "condition": "selection"
}

References:
  - https://persistence-info.github.io/Data/mpnotify.html
  - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek