registry_event log source Sigma rules

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

windows

Detects registry key used by Leviathan APT in Malaysian focused campaign

windows

Detects registry keys created in OceanLotus (also known as APT32) attacks

windows

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows

Detects Pandemic Windows Implant

windows

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

windows

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

windows

Detects the presence of a registry key created during Azorult execution

windows

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows

Detects the use of Windows Credential Editor (WCE)

windows

Detects various indicators of Microsoft Connection Manager Profile Installer execution

windows

Sysmon registry detection of a local hidden user account.

windows

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

windows

Detects a method to load DLL via LSASS process using an undocumented Registry key

windows

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.

windows

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

windows

Detects abusing Windows 10 Narrator's Feedback-Hub

windows

Detects NetNTLM downgrade attack

windows

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

windows

Detects actions caused by the RedMimicry Winnti playbook

windows

Detects persistence registry keys for Recycle Bin

windows

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

windows

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

windows

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

windows

Detects Processes accessing the camera and microphone from suspicious folder

windows

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

windows

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

windows

Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.

windows

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

windows

Detects potential malicious modification of run keys by winekey or team9 backdoor

windows

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

windows

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

windows

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

windows

Detects the modification of the PortProxy registry key which is used for port forwarding.

windows

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

windows

Detects value modification of registry key containing path to binary used as screensaver.

windows

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

windows

Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

windows

Alerts on trust record modification within the registry, indicating usage of macros

windows

Detects the creation of a scheduled task via Registry keys.

windows