Detection rules › YARA-L

YARA-L rules: 12

Rule	Severity
sap change documents sensitive profile assignment data table	`critical`
Session Manager Autorun Keys Modification	`medium`
Suspicious Filewrites To Sharepoint Layouts	`high`
Suspicious User Agent Strings associated withGraphRunner	`low`

sap change documents sensitive profile assignment data table

Severity: critical
Time window: 30m
Match by: principal_user
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects the assignment of highly privileged SAP profiles via Change Documents.

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1098` Account Manipulation

Rule Body

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_change_documents_sensitive_profile_assignment_data_table {

    meta:
        author = "Google Cloud Security"
        description = "Detects the assignment of highly privileged SAP profiles via Change Documents."
        severity = "Critical"
        tactic = "TA0004"
        technique = "T1098"

    events:
        $e.metadata.log_type = "SAP_CHANGE_DOCUMENT"
        $e.target.resource.attribute.labels["TABKEY"] in %sap_sensitive_profiles.profile
        $e.target.resource.name = "IDENTITY"

        $principal_user = $e.principal.user.userid


    match:
        $principal_user over 30m

    outcome:
        $target_user = array_distinct($e.target.resource.product_object_id)
        $tcode = array_distinct($e.target.application)
        $tabname = array_distinct($e.target.resource.attribute.labels["TABNAME"])
        $sensitive_profile_assigned = array_distinct($e.target.resource.attribute.labels["TABKEY"])

    condition:
        $e

}

YARA-L Rule Structure

Condition

Fires when at least one $e event in the 30m window.

Events

`$e`

metadata.log_type = "SAP_CHANGE_DOCUMENT"
target.resource.attribute.labels["TABKEY"] in "%sap_sensitive_profiles.profile"
target.resource.name = "IDENTITY"

Match and Correlation

Match key: $principal_user
Within: 30m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`target_user`	`array_distinct($e.target.resource.product_object_id)`
`tcode`	`array_distinct($e.target.application)`
`tabname`	`array_distinct($e.target.resource.attribute.labels["TABNAME"])`
`sensitive_profile_assigned`	`array_distinct($e.target.resource.attribute.labels["TABKEY"])`

Session Manager Autorun Keys Modification

Severity: medium
Type: Detection
Time window: 5m
Match by: hostname
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Source: github.com/chronicle/detection-rules

Detects modification of autostart extensibility point (ASEP) in registry

Known False Positives

Legitimate software automatically sets up autorun keys for legitimate reason

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

References

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)
Security-Auditing	Event ID 4657: A registry value was modified.

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule session_manager_autorun_keys_modification {

  meta:
    author = "Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)"
    description = "Detects modification of autostart extensibility point (ASEP) in registry"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Session Manager Autorun Keys Modification"
    rule_id = "mr_4ec3053f-3617-4262-93ae-838dc542610c"
    sigma_uuid = "046218bd-e0d8-4113-a3c3-895a12b2b298"
    sigma_status = "test"
    tactic = "TA0003"
    //tactic = "TA0004"
    technique = "T1547.001"
    //technique = "T1546.009"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "Medium"
    priority = "Medium"
    false_positives = "Legitimate software automatically sets up autorun keys for legitimate reason"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    strings.contains(strings.to_lower($reg.target.registry.registry_key), "system\\currentcontrolset\\control\\session manager")
    (
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\setupexecute") or
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\s0initialcommand") or
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\knowndlls") or
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\execute") or
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\bootexecute") or
      strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\appcertdlls")
    )
    NOT $reg.target.registry.registry_value_data = "(Empty)" nocase

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}

YARA-L Rule Structure

Condition

Fires when at least one $reg event in the 5m window.

Events

`$reg` `REGISTRY_MODIFICATION` (`13`, `4657`)

target.registry.registry_key contains "system\currentcontrolset\control\session manager"
target.registry.registry_key contains "\setupexecute"
target.registry.registry_key contains "\s0initialcommand"
target.registry.registry_key contains "\knowndlls"
target.registry.registry_key contains "\execute"
target.registry.registry_key contains "\bootexecute"
target.registry.registry_key contains "\appcertdlls"
target.registry.registry_value_data = "(Empty)"

Match and Correlation

Match key: $hostname (principal.hostname)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))`
`principal_hostname`	`array_distinct($reg.principal.hostname)`
`principal_process_pid`	`array_distinct($reg.principal.process.pid)`
`principal_process_file_full_path`	`array_distinct($reg.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($reg.principal.process.product_specific_process_id)`
`principal_user_userid`	`array_distinct($reg.principal.user.userid)`
`target_registry_key`	`array_distinct($reg.target.registry.registry_key)`
`target_registry_value_data`	`array_distinct($reg.target.registry.registry_value_data)`
`log_type`	`array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))`

Suspicious Filewrites To Sharepoint Layouts

Severity: high
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 2: A process changed a file creation time
Sysmon	Event ID 11: FileCreate
Sysmon	Event ID 23: FileDelete (File Delete archived)

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule ttp_windows_suspicious_filewrites_to_sharepoint_layouts {

  meta:
    author = "Google Cloud Security"
    rule_name = "Suspicious Filewrites To Sharepoint Layouts"
    description = "Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory."
    severity = "High"
    tactic = "TA0003"
    technique = "T1505.003"
    rule_id = "mr_06c0d5b5-8185-4584-8db0-28c8fd4971ea"

  events:
    (
      $e.metadata.event_type = "FILE_CREATION" or
      $e.metadata.event_type = "FILE_MODIFICATION" or
      $e.metadata.event_type = "FILE_MOVE"
    )
    $e.target.file.full_path = /\\\d{1,2}\\TEMPLATE\\LAYOUTS\\[^\\]+$/ nocase
    $e.principal.process.file.full_path = /(^|\\)(pwsh|cmd|powershell)\.exe$/ nocase
    not $e.principal.process.command_line = /C:\\SP\\Automation\\\\AutoSPInstallerMain.ps1\s+C:\\SP\\Automation\\\\AutoSPInstallerInput.xml/ nocase

  outcome:
    $principal_hostname = $e.principal.hostname
    $risk_score = 85
    $vendor_name = array($e.metadata.vendor_name)
    $product_name = $e.metadata.product_name
    $victim_uid = $e.principal.asset.asset_id
    $victim_name = $e.principal.asset.hostname
    $victim_netid = array($e.principal.ip)
    $adversary_uid = $e.principal.user.userid
    $adversary_name = $e.principal.user.user_display_name
    $adversary_netid = $e.principal.user.windows_sid
    $tmp1 = max(
      if($e.security_result.action != "BLOCK" and $e.security_result.action != "UNKNOWN_ACTION", 2)
    )
    $tmp2 = max(
      if($e.security_result.action = "BLOCK", 1)
    )
    $result = arrays.index_to_str(strings.split("attempted,failed,succeeded,succeeded"), $tmp1 + $tmp2)
    $result_time = $e.metadata.event_timestamp.seconds
    $event_count = 1

  condition:
    $e
}

YARA-L Rule Structure

Condition

Fires when at least one $e event.

Events

`$e` `FILE_CREATION` (`2`, `11`, `23`)

target.file.full_path matches "\\\d{1,2}\\TEMPLATE\\LAYOUTS\\[^\\]+$"
principal.process.file.full_path matches "(^|\\)(pwsh|cmd|powershell)\.exe$"
principal.process.command_line matches "C:\\SP\\Automation\\\\AutoSPInstallerMain.ps1\s+C:\\SP\\Automation\\\\AutoSPInstallerInput.xml"

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`principal_hostname`	`$e.principal.hostname`
`risk_score`	`85`
`vendor_name`	`array($e.metadata.vendor_name)`
`product_name`	`$e.metadata.product_name`
`victim_uid`	`$e.principal.asset.asset_id`
`victim_name`	`$e.principal.asset.hostname`
`victim_netid`	`array($e.principal.ip)`
`adversary_uid`	`$e.principal.user.userid`
`adversary_name`	`$e.principal.user.user_display_name`
`adversary_netid`	`$e.principal.user.windows_sid`
`tmp1`	`max( if($e.security_result.action != "BLOCK" and $e.security_result.action != "UNKNOWN_ACTION", 2) )`
`tmp2`	`max( if($e.security_result.action = "BLOCK", 1) )`
`result`	`arrays.index_to_str(strings.split("attempted,failed,succeeded,succeeded"), $tmp1 + $tmp2)`
`result_time`	`$e.metadata.event_timestamp.seconds`
`event_count`	`1`

Suspicious User Agent Strings associated withGraphRunner

Severity: low
Type: Hunt
Time window: 5m
Match by: identifier
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

GraphRunner contains a function that forges UA strings. The UA strings below are found in that function. Can be used for other UA strings if desired

References

https://github.com/dafthack/GraphRunner/blob/main/GraphRunner.ps1

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule graphrunner_suspicious_user_agent_strings {

  meta:
    author = "Google Cloud Security"
    description = "GraphRunner contains a function that forges UA strings. The UA strings below are found in that function. Can be used for other UA strings if desired"
    rule_id = "mr_61809764-4da4-48dc-aa14-aa28c00be3fa"
    rule_name = "Suspicious User Agent Strings associated withGraphRunner"
    //Currently used by default in the following functions
    //Get-GraphTokens, Invoke-RefreshGraphTokens, Invoke-RefreshToSharePointToken, Invoke-ImmersiveFileReader, Invoke-BruteClientIDAccess
    assumption = "Function can be modified to change strings to more recent browser versions, upkeep and monitoring is required."
    reference = "https://github.com/dafthack/GraphRunner/blob/main/GraphRunner.ps1"
    type = "Hunt"
    data_source = "Azure Activity, MS Graph Activity Logs"
    platform = "Azure"
    severity = "Low"
    priority = "Low"

  events:
    //Focused on O365/Entra ID Logs - Could expand further for other use cases if desired
    (
        $web.metadata.product_name = "Azure Activity" OR
        $web.metadata.product_name = "Office 365" OR
        $web.metadata.product_name = "Azure AD" OR
        $web.metadata.product_name = "Azure AD Directory Audit" OR
        $web.metadata.product_event_type = "Microsoft Graph Activity"
    )
    //Displayed here as strings separated by OR statement
    //Each line is commented with device or browser or combination as specified in GraphRunner
    //Could also convert to regex to refine if desired or used with a reference list
    (
        $web.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" nocase or // Mac/Chrome | Chrome
        $web.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0" nocase or // Mac/Firefox
        $web.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/604.1 Edg/91.0.100.0" nocase or // Mac/Edge
        $web.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15" nocase or // Mac/Safari | Mac | Safari
        $web.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" nocase or // Windows/IE | IE
        $web.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" nocase or // Windows/Chrome
        $web.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:70.0) Gecko/20100101 Firefox/70.0" nocase or // Windows/Firefox | Firefox
        $web.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042" nocase or // Windows/Edge | Windows
        $web.network.http.user_agent = "Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30" nocase or // AndroidMobile/Android | AndroidMobile | Android
        $web.network.http.user_agent = "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Mobile Safari/537.36" nocase or // AndroidMobile/Chrome
        $web.network.http.user_agent = "Mozilla/5.0 (Android 4.4; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0" nocase or // AndroidMobile/Firefox
        $web.network.http.user_agent = "Mozilla/5.0 (Linux; Android 8.1.0; Pixel Build/OPM4.171019.021.D1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36 EdgA/42.0.0.2057" nocase or // AndroidMobile/Edge
        $web.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.114 Mobile/15E148 Safari/604.1" nocase or // iPhone/Chrome
        $web.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) FxiOS/1.0 Mobile/12F69 Safari/600.1.4" nocase or // iPhone/Firefox
        $web.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 EdgiOS/44.5.0.10 Mobile/15E148 Safari/604.1" nocase or // iPhone/Edge
        $web.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" nocase or // iPhone/Safari | iPhone
        $web.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" nocase // Edge
    )
    //assumes that every event would have either a principal.ip or principal.user.userid, could be modfied include other common value to aggregate detections
    $identifier = strings.coalesce($web.principal.ip, $web.principal.user.userid)

  match:
    $identifier over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($web.metadata.id)
    $principal_email = array_distinct($web.principal.user.email_addresses)
    $principal_ip = array_distinct($web.principal.ip)
    $user_agent = array_distinct($web.network.http.user_agent)
    $location = array_distinct(strings.concat("City: ", $web.principal.location.city, " State: ",
        $web.principal.location.state, " Country: ", $web.principal.location.country_or_region))
    $session_id = array_distinct(if($web.metadata.product_event_type = "Microsoft Graph Activity", $web.network.session_id, ""))
    $login_detail = array_distinct(if($web.metadata.event_type = "USER_LOGIN", $web.security_result.category_details, ""))
    $target_url = array_distinct(if($web.metadata.product_event_type = "Microsoft Graph Activity", $web.target.url, ""))

  condition:
    $web
}

YARA-L Rule Structure

Condition

Fires when at least one $web event in the 5m window.

Events

`$web`

metadata.product_event_type = "Microsoft Graph Activity"
network.http.user_agent is one of:
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/604.1 Edg/91.0.100.0
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
- Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
- Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
- Mozilla/5.0 (Windows NT 10.0; WOW64; rv:70.0) Gecko/20100101 Firefox/70.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042
- Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
- Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Mobile Safari/537.36
- Mozilla/5.0 (Android 4.4; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0
- Mozilla/5.0 (Linux; Android 8.1.0; Pixel Build/OPM4.171019.021.D1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36 EdgA/42.0.0.2057
- Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.114 Mobile/15E148 Safari/604.1
- Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) FxiOS/1.0 Mobile/12F69 Safari/600.1.4
- Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 EdgiOS/44.5.0.10 Mobile/15E148 Safari/604.1
- Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36

Match and Correlation

Match key: $identifier
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`35`
`event_count`	`count_distinct($web.metadata.id)`
`principal_email`	`array_distinct($web.principal.user.email_addresses)`
`principal_ip`	`array_distinct($web.principal.ip)`
`user_agent`	`array_distinct($web.network.http.user_agent)`
`location`	`array_distinct(strings.concat("City: ", $web.principal.location.city, " State: ", $web.principal.location.state, " Country: ", $web.principal.location.country_or_region))`
`session_id`	`array_distinct(if($web.metadata.product_event_type = "Microsoft Graph Activity", $web.network.session_id, ""))`
`login_detail`	`array_distinct(if($web.metadata.event_type = "USER_LOGIN", $web.security_result.category_details, ""))`
`target_url`	`array_distinct(if($web.metadata.product_event_type = "Microsoft Graph Activity", $web.target.url, ""))`

Back to all YARA-L rules

YARA-L rules: 12

sap change documents sensitive profile assignment data table

MITRE ATT&CK Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$e

Match and Correlation

Outcome

Session Manager Autorun Keys Modification

Known False Positives

MITRE ATT&CK Coverage

References

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$reg REGISTRY_MODIFICATION (13, 4657)

Match and Correlation

Outcome

Suspicious Filewrites To Sharepoint Layouts

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$e FILE_CREATION (2, 11, 23)

Outcome

Suspicious User Agent Strings associated withGraphRunner

References

Rule Body

YARA-L Rule Structure

Condition

Events

$web

Match and Correlation

Outcome

`$e`

`$reg` `REGISTRY_MODIFICATION` (`13`, `4657`)

`$e` `FILE_CREATION` (`2`, `11`, `23`)

`$web`