Log source category
registry_add log source Sigma rules
3 Sigma detection rules in the library use the registry_add log source, mostly on windows. The registry_add category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
Potential NetWire RAT Activity - Registry
highDetects registry keys related to NetWire RAT
windows
Potential Ursnif Malware Activity - Registry
highDetects registry keys related to Ursnif malware.
windows
Potential Persistence Via Disk Cleanup Handler - Registry
mediumDetects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
windows