AllowProtectedRenames Registry Modification

[rule]
description = """
Identifies attempts to enable the modification of Trusted Installer protected resources via PendingFileRename operation.
Malware may change this setting to hijack existing resources for execution and persistence.
"""
id = "6dad397a-7e26-4c5b-9a24-d19016f2ad03"
license = "Elastic License v2"
name = "AllowProtectedRenames Registry Modification"
os_list = ["windows"]
reference = [
    "https://qtechbabble.wordpress.com/2020/06/26/use-pendingfilerenameoperations-registry-key-to-automatically-delete-a-file-on-reboot/",
]
version = "1.0.6"

query = '''
registry where process.name != null and
 registry.value : "AllowProtectedRenames" and registry.data.strings : "1" and 
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (86)\\*", "\\Device\\Mup\\lansweeper\\*$\\uninstall_flash_player.exe") and
 not (process.code_signature.status : "trusted" and not process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.1.0"