Sigma rules: 2k

title: Active Directory Certificate Services Denied Certificate Enrollment Request
id: 994bfd6d-0a2e-481e-a861-934069fcf5f5
status: test
description: |
    Detects denied requests by Active Directory Certificate Services.
    Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
    - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
author: '@SerkinValery'
date: 2024-03-07
tags:
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1553.004
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-CertificationAuthority'
        EventID: 53
    condition: selection
falsepositives:
    - Unknown
level: low

title: Apache Spark Shell Command Injection - ProcessCreation
id: c8a5f584-cdc8-42cc-8cce-0398e4265de3
status: test
description: Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective
references:
    - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
    - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
    - https://github.com/apache/spark/pull/36315/files
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-20
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-33891
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\bash'
        CommandLine|contains:
            - 'id -Gn `'
            - "id -Gn '"
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Azure Application Gateway Modified or Deleted
id: ad87d14e-7599-4633-ba81-aeb60cfe8cd6
status: test
description: Identifies when a application gateway is modified or deleted.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
author: Austin Songer
date: 2021-08-16
modified: 2022-08-23
tags:
    - attack.impact
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName:
            - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE
            - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE
    condition: selection
falsepositives:
    - Application gateway being modified or deleted may be performed by a system administrator.
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: Cisco Discovery
id: 9705a6a1-6db6-4a16-a987-15b7151e299b
status: test
description: Find information about network devices that is not stored in config files
references:
    - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
author: Austin Clark
date: 2019-08-12
modified: 2023-01-04
tags:
    - attack.discovery
    - attack.t1083
    - attack.t1201
    - attack.t1057
    - attack.t1018
    - attack.t1082
    - attack.t1016
    - attack.t1049
    - attack.t1033
    - attack.t1124
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'dir'
        - 'show arp'
        - 'show cdp'
        - 'show clock'
        - 'show ip interface'
        - 'show ip route'
        - 'show ip sockets'
        - 'show processes'
        - 'show ssh'
        - 'show users'
        - 'show version'
    condition: keywords
falsepositives:
    - Commonly used by administrators for troubleshooting
level: low

title: Compress Data and Lock With Password for Exfiltration With 7-ZIP
id: 9fbf5927-5261-4284-a71d-f681029ea574
status: test
description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
author: frack113
date: 2021-07-27
modified: 2026-06-05
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Description|contains: '7-Zip'
        - Image|endswith:
              - '\7z.exe'
              - '\7zr.exe'
              - '\7za.exe'
        - OriginalFileName:
              - '7z.exe'
              - '7za.exe'
              - '7zr.exe'
    selection_password:
        CommandLine|contains: ' -p'
    selection_action:
        CommandLine|contains:
            - ' a '
            - ' u '
    condition: all of selection_*
falsepositives:
    - Legitimate activity is expected since compressing files with a password is common.
level: medium

title: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security
id: 4c198a60-7d05-4daf-8bf7-4136fb6f5c62
related:
    - id: 44d7af7e-88e6-4490-be11-55f7ff4d9fc1
      type: similar
status: test
description: |
    This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708.
    This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.cve.org/CVERecord?id=CVE-2024-1708
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
author: Matt Anderson, Caleb Stewart, Huntress
date: 2024-02-20
tags:
    - attack.initial-access
    - attack.persistence
    - cve.2024-1708
    - detection.emerging-threats
logsource:
    product: windows
    service: security
    definition: 'Requirements: SACLs must be enabled for the ScreenConnect directory'
detection:
    selection:
        EventID: 4663
        ObjectType: 'File'
        ProcessName|contains: 'ScreenConnect.Service.exe'
        AccessMask: '0x6'
        ObjectName|endswith:
            - 'ScreenConnect\\App_Extensions\\*.ashx'
            - 'ScreenConnect\\App_Extensions\\*.aspx'
    filter_main_legit_extension:
        ObjectName|contains: 'ScreenConnect\App_Extensions\\*\\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: critical

title: Diamond Sleet APT Process Activity Indicators
id: b5495d8d-24ad-4a44-8caf-ceae9a07a5c2
status: test
description: Detects process creation activity indicators related to Diamond Sleet APT
references:
    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-24
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: ' uTYNkfKxHiZrx3KJ'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: DNS Query To Common Malware Hosting and Shortener Services
id: f8c1e80b-c73a-476a-ae24-6c72528b1521
status: experimental
description: |
    Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
    These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
    Such DNS activity can indicate potential delivery or command-and-control communication attempts.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
author: Ahmed Nosir (@egycondor)
date: 2025-06-02
tags:
    - attack.command-and-control
    - attack.t1071.004
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|contains:
            - 'msapp.workers.dev'
            - 'trycloudflare.com'
            - 'infinityfreeapp.com'
            - 'my5353.com'
            - 'reurl.cc'
            - 'lihi.cc'
            - 'tinyurl.com'
    condition: selection
falsepositives:
    - Legitimate use of these services is possible but rare in enterprise environments
level: medium

title: FakeUpdates/SocGholish Activity
id: 97805087-93ab-4203-b5cb-287cda6aecaa
status: test
description: Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.
references:
    - https://twitter.com/th3_protoCOL/status/1536788652889497600
    - https://twitter.com/1ZRR4H/status/1537501582727778304
author: '@kostastsale'
date: 2022-06-16
modified: 2024-08-23
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        ParentCommandLine|contains|all:
            - '\AppData\Local\Temp'
            - '.zip'
            - 'update'
            - '.js'
        ParentCommandLine|contains:
            - 'Chrome'
            - 'Edge'
            - 'Firefox'
            - 'Opera'
            - 'Brave' # Not seen in campaigns
            - 'Vivaldi' # Not seen in campaigns
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: HackTool - Windows Credential Editor (WCE) Execution
id: 7aa7009a-28b9-4344-8c1f-159489a390df
status: test
description: |
    Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
    It is often used by threat actors for credential dumping and lateral movement within compromised networks.
references:
    - https://www.ampliasecurity.com/research/windows-credentials-editor/
author: Florian Roth (Nextron Systems)
date: 2019-12-31
modified: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.s0005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\WCE.exe'
            - '\WCE64.exe'
    selection_hash:
        Hashes|contains:
            - 'IMPHASH=136F0A8572C058A96436C82E541E4C41'
            - 'IMPHASH=589657C64DDE88533186C39F82FA1F50'
            - 'IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF'
            - 'IMPHASH=7D490037BF450877E6D0287BDCFF8D2E'
            - 'IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED'
            - 'IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F'
            - 'IMPHASH=BA434A7A729EEC20E136CA4C32D6C740'
            - 'IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8'
            - 'IMPHASH=E96A73C7BF33A464C510EDE582318BF2'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical

title: Host unconstrained delegation settings changed for potential abuse (Rubeus)
description: Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/
- https://www.alsid.com/crb_article/kerberos-delegation/
- https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
- https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation
- https://www.guidepointsecurity.com/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
- https://stealthbits.com/blog/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/
- https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
- https://pentestlab.blog/2022/03/21/unconstrained-delegation/
- https://www.thehacker.recipes/ad/movement/kerberos/delegations#talk
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection: # Delegation to any service, Kerberos only
    EventID: 4742
    UserAccountControl: '%%2093' # Enable option "Trust this computer for delegation to any service (Kerberos only)"
  condition: selection
falsepositives:
- Rare administrator modifying host delegation settings
level: high

title: JAMF MDM Execution
id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49
status: test
description: |
    Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.
references:
    - https://github.com/MythicAgents/typhon/
    - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
    - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
author: Jay Pandit
date: 2023-08-22
tags:
    - attack.execution
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/jamf'
        CommandLine|contains:
            # Note: add or remove commands according to your policy
            - 'createAccount'
            - 'manage'
            - 'removeFramework'
            - 'removeMdmProfile'
            - 'resetPassword'
            - 'setComputerName'
    condition: selection
falsepositives:
    - Legitimate use of the JAMF CLI tool by IT support and administrators
level: low

title: Linux Network Service Scanning - Auditd
id: 3761e026-f259-44e6-8826-719ed8079408
related:
    - id: 3e102cd9-a70d-4a7a-9508-403963092f31
      type: derived
status: test
description: Detects enumeration of local or remote network services.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
author: Alejandro Ortuno, oscd.community
date: 2020-10-21
modified: 2023-09-26
tags:
    - attack.discovery
    - attack.t1046
logsource:
    product: linux
    service: auditd
    definition: 'Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183'
detection:
    selection:
        type: 'SYSCALL'
        exe|endswith:
            - '/telnet'
            - '/nmap'
            - '/netcat'
            - '/nc'
            - '/ncat'
            - '/nc.openbsd'
        key: 'network_connect_4'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: low

title: Malicious PowerShell Scripts - FileCreation
id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
related:
    - id: 41025fd7-0466-4650-a813-574aaacbe7f4
      type: similar
status: test
description: Detects the creation of known offensive powershell scripts used for exploitation
references:
    - https://github.com/PowerShellMafia/PowerSploit
    - https://github.com/NetSPI/PowerUpSQL
    - https://github.com/CsEnox/EventViewer-UACBypass
    - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu
    - https://github.com/nettitude/Invoke-PowerThIEf
    - https://github.com/S3cur3Th1sSh1t/WinPwn
    - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
    - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
    - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
    - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
    - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1
    - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ # Invoke-TotalExec
    - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ # Invoke-TotalExec
    - https://github.com/HarmJ0y/DAMP
    - https://github.com/samratashok/nishang
    - https://github.com/DarkCoderSc/PowerRunAsSystem/
    - https://github.com/besimorhino/powercat
    - https://github.com/Kevin-Robertson/Powermad
    - https://github.com/adrecon/ADRecon
    - https://github.com/adrecon/AzureADRecon
    - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1
    - https://github.com/The-Viper-One/Invoke-PowerDPAPI/
    - https://github.com/Arno0x/DNSExfiltrator/
author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein
date: 2018-04-07
modified: 2025-12-10
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: file_event
    product: windows
detection:
    selection_generic:
        TargetFilename|endswith:
            # Note: Please ensure alphabetical order when adding new entries
            - '\Add-ConstrainedDelegationBackdoor.ps1'
            - '\Add-Exfiltration.ps1'
            - '\Add-Persistence.ps1'
            - '\Add-RegBackdoor.ps1'
            - '\Add-RemoteRegBackdoor.ps1'
            - '\Add-ScrnSaveBackdoor.ps1'
            - '\ADRecon.ps1'
            - '\AzureADRecon.ps1'
            - '\BadSuccessor.ps1'
            - '\Check-VM.ps1'
            - '\ConvertTo-ROT13.ps1'
            - '\Copy-VSS.ps1'
            - '\Create-MultipleSessions.ps1'
            - '\DNS_TXT_Pwnage.ps1'
            - '\dnscat2.ps1'
            - '\Do-Exfiltration.ps1'
            - '\DomainPasswordSpray.ps1'
            - '\Download_Execute.ps1'
            - '\Download-Execute-PS.ps1'
            - '\Enable-DuplicateToken.ps1'
            - '\Enabled-DuplicateToken.ps1'
            - '\Execute-Command-MSSQL.ps1'
            - '\Execute-DNSTXT-Code.ps1'
            - '\Execute-OnTime.ps1'
            - '\ExetoText.ps1'
            - '\Exploit-Jboss.ps1'
            - '\Find-AVSignature.ps1'
            - '\Find-Fruit.ps1'
            - '\Find-GPOLocation.ps1'
            - '\Find-TrustedDocuments.ps1'
            - '\FireBuster.ps1'
            - '\FireListener.ps1'
            - '\Get-ApplicationHost.ps1'
            - '\Get-ChromeDump.ps1'
            - '\Get-ClipboardContents.ps1'
            - '\Get-ComputerDetail.ps1'
            - '\Get-FoxDump.ps1'
            - '\Get-GPPAutologon.ps1'
            - '\Get-GPPPassword.ps1'
            - '\Get-IndexedItem.ps1'
            - '\Get-Keystrokes.ps1'
            - '\Get-LSASecret.ps1'
            - '\Get-MicrophoneAudio.ps1'
            - '\Get-PassHashes.ps1'
            - '\Get-PassHints.ps1'
            - '\Get-RegAlwaysInstallElevated.ps1'
            - '\Get-RegAutoLogon.ps1'
            - '\Get-RickAstley.ps1'
            - '\Get-Screenshot.ps1'
            - '\Get-SecurityPackages.ps1'
            - '\Get-ServiceFilePermission.ps1'
            - '\Get-ServicePermission.ps1'
            - '\Get-ServiceUnquoted.ps1'
            - '\Get-SiteListPassword.ps1'
            - '\Get-System.ps1'
            - '\Get-TimedScreenshot.ps1'
            - '\Get-UnattendedInstallFile.ps1'
            - '\Get-Unconstrained.ps1'
            - '\Get-USBKeystrokes.ps1'
            - '\Get-VaultCredential.ps1'
            - '\Get-VulnAutoRun.ps1'
            - '\Get-VulnSchTask.ps1'
            - '\Get-WebConfig.ps1'
            - '\Get-WebCredentials.ps1'
            - '\Get-WLAN-Keys.ps1'
            - '\Gupt-Backdoor.ps1'
            - '\HTTP-Backdoor.ps1'
            - '\HTTP-Login.ps1'
            - '\Install-ServiceBinary.ps1'
            - '\Install-SSP.ps1'
            - '\Invoke-ACLScanner.ps1'
            - '\Invoke-ADSBackdoor.ps1'
            - '\Invoke-AmsiBypass.ps1'
            - '\Invoke-ARPScan.ps1'
            - '\Invoke-BackdoorLNK.ps1'
            - '\Invoke-BadPotato.ps1'
            - '\Invoke-BetterSafetyKatz.ps1'
            - '\Invoke-BruteForce.ps1'
            - '\Invoke-BypassUAC.ps1'
            - '\Invoke-Carbuncle.ps1'
            - '\Invoke-Certify.ps1'
            - '\Invoke-ConPtyShell.ps1'
            - '\Invoke-CredentialInjection.ps1'
            - '\Invoke-CredentialsPhish.ps1'
            - '\Invoke-DAFT.ps1'
            - '\Invoke-DCSync.ps1'
            - '\Invoke-Decode.ps1'
            - '\Invoke-DinvokeKatz.ps1'
            - '\Invoke-DllInjection.ps1'
            - '\Invoke-DNSExfiltrator.ps1'
            - '\Invoke-DNSUpdate.ps1'
            - '\Invoke-DowngradeAccount.ps1'
            - '\Invoke-EgressCheck.ps1'
            - '\Invoke-Encode.ps1'
            - '\Invoke-EventViewer.ps1'
            - '\Invoke-Eyewitness.ps1'
            - '\Invoke-FakeLogonScreen.ps1'
            - '\Invoke-Farmer.ps1'
            - '\Invoke-Get-RBCD-Threaded.ps1'
            - '\Invoke-Gopher.ps1'
            - '\Invoke-Grouper2.ps1'
            - '\Invoke-Grouper3.ps1'
            - '\Invoke-HandleKatz.ps1'
            - '\Invoke-Interceptor.ps1'
            - '\Invoke-Internalmonologue.ps1'
            - '\Invoke-Inveigh.ps1'
            - '\Invoke-InveighRelay.ps1'
            - '\Invoke-JSRatRegsvr.ps1'
            - '\Invoke-JSRatRundll.ps1'
            - '\Invoke-KrbRelay.ps1'
            - '\Invoke-KrbRelayUp.ps1'
            - '\Invoke-LdapSignCheck.ps1'
            - '\Invoke-Lockless.ps1'
            - '\Invoke-MalSCCM.ps1'
            - '\Invoke-Mimikatz.ps1'
            - '\Invoke-MimikatzWDigestDowngrade.ps1'
            - '\Invoke-Mimikittenz.ps1'
            - '\Invoke-MITM6.ps1'
            - '\Invoke-NanoDump.ps1'
            - '\Invoke-NetRipper.ps1'
            - '\Invoke-NetworkRelay.ps1'
            - '\Invoke-NinjaCopy.ps1'
            - '\Invoke-OxidResolver.ps1'
            - '\Invoke-P0wnedshell.ps1'
            - '\Invoke-P0wnedshellx86.ps1'
            - '\Invoke-Paranoia.ps1'
            - '\Invoke-PortScan.ps1'
            - '\Invoke-PoshRatHttp.ps1'
            - '\Invoke-PoshRatHttps.ps1'
            - '\Invoke-PostExfil.ps1'
            - '\Invoke-PowerDump.ps1'
            - '\Invoke-PowerDPAPI.ps1'
            - '\Invoke-PowerShellIcmp.ps1'
            - '\Invoke-PowerShellTCP.ps1'
            - '\Invoke-PowerShellTcpOneLine.ps1'
            - '\Invoke-PowerShellTcpOneLineBind.ps1'
            - '\Invoke-PowerShellUdp.ps1'
            - '\Invoke-PowerShellUdpOneLine.ps1'
            - '\Invoke-PowerShellWMI.ps1'
            - '\Invoke-PowerThIEf.ps1'
            - '\Invoke-PPLDump.ps1'
            - '\Invoke-Prasadhak.ps1'
            - '\Invoke-PsExec.ps1'
            - '\Invoke-PsGcat.ps1'
            - '\Invoke-PsGcatAgent.ps1'
            - '\Invoke-PSInject.ps1'
            - '\Invoke-PsUaCme.ps1'
            - '\Invoke-ReflectivePEInjection.ps1'
            - '\Invoke-ReverseDNSLookup.ps1'
            - '\Invoke-Rubeus.ps1'
            - '\Invoke-RunAs.ps1'
            - '\Invoke-SafetyKatz.ps1'
            - '\Invoke-SauronEye.ps1'
            - '\Invoke-SCShell.ps1'
            - '\Invoke-Seatbelt.ps1'
            - '\Invoke-ServiceAbuse.ps1'
            - '\Invoke-SessionGopher.ps1'
            - '\Invoke-ShellCode.ps1'
            - '\Invoke-SMBScanner.ps1'
            - '\Invoke-Snaffler.ps1'
            - '\Invoke-Spoolsample.ps1'
            - '\Invoke-SSHCommand.ps1'
            - '\Invoke-SSIDExfil.ps1'
            - '\Invoke-StandIn.ps1'
            - '\Invoke-StickyNotesExtract.ps1'
            - '\Invoke-Tater.ps1'
            - '\Invoke-Thunderfox.ps1'
            - '\Invoke-ThunderStruck.ps1'
            - '\Invoke-TokenManipulation.ps1'
            - '\Invoke-Tokenvator.ps1'
            - '\Invoke-TotalExec.ps1'
            - '\Invoke-UrbanBishop.ps1'
            - '\Invoke-UserHunter.ps1'
            - '\Invoke-VoiceTroll.ps1'
            - '\Invoke-Whisker.ps1'
            - '\Invoke-WinEnum.ps1'
            - '\Invoke-winPEAS.ps1'
            - '\Invoke-WireTap.ps1'
            - '\Invoke-WmiCommand.ps1'
            - '\Invoke-WScriptBypassUAC.ps1'
            - '\Invoke-Zerologon.ps1'
            - '\Keylogger.ps1'
            - '\MailRaider.ps1'
            - '\New-HoneyHash.ps1'
            - '\OfficeMemScraper.ps1'
            - '\Offline_Winpwn.ps1'
            - '\Out-CHM.ps1'
            - '\Out-DnsTxt.ps1'
            - '\Out-Excel.ps1'
            - '\Out-HTA.ps1'
            - '\Out-Java.ps1'
            - '\Out-JS.ps1'
            - '\Out-Minidump.ps1'
            - '\Out-RundllCommand.ps1'
            - '\Out-SCF.ps1'
            - '\Out-SCT.ps1'
            - '\Out-Shortcut.ps1'
            - '\Out-WebQuery.ps1'
            - '\Out-Word.ps1'
            - '\Parse_Keys.ps1'
            - '\Port-Scan.ps1'
            - '\PowerBreach.ps1'
            - '\powercat.ps1'
            - '\Powermad.ps1'
            - '\PowerRunAsSystem.psm1'
            - '\PowerSharpPack.ps1'
            - '\PowerUp.ps1'
            - '\PowerUpSQL.ps1'
            - '\PowerView.ps1'
            - '\PSAsyncShell.ps1'
            - '\RemoteHashRetrieval.ps1'
            - '\Remove-Persistence.ps1'
            - '\Remove-PoshRat.ps1'
            - '\Remove-Update.ps1'
            - '\Run-EXEonRemote.ps1'
            - '\Schtasks-Backdoor.ps1'
            - '\Set-DCShadowPermissions.ps1'
            - '\Set-MacAttribute.ps1'
            - '\Set-RemotePSRemoting.ps1'
            - '\Set-RemoteWMI.ps1'
            - '\Set-Wallpaper.ps1'
            - '\Show-TargetScreen.ps1'
            - '\Speak.ps1'
            - '\Start-CaptureServer.ps1'
            - '\Start-WebcamRecorder.ps1'
            - '\StringToBase64.ps1'
            - '\TexttoExe.ps1'
            - '\Veeam-Get-Creds.ps1'
            - '\VolumeShadowCopyTools.ps1'
            - '\WinPwn.ps1'
            - '\WSUSpendu.ps1'
    selection_invoke_sharp:
        TargetFilename|contains: 'Invoke-Sharp' # Covers all "Invoke-Sharp" variants
        TargetFilename|endswith: '.ps1'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Microsoft Excel Add-In Loaded
id: c5f4b5cb-4c25-4249-ba91-aa03626e3185
status: test
description: Detects Microsoft Excel loading an Add-In (.xll) file
references:
    - https://www.mandiant.com/resources/blog/lnk-between-browsers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-12
tags:
    - attack.execution
    - attack.t1204.002
    - detection.threat-hunting
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\excel.exe'
        ImageLoaded|endswith: '.xll'
    condition: selection
falsepositives:
    - The rules is only looking for ".xll" loads. So some false positives are expected with legitimate and allowed XLLs
level: low

title: Microsoft Workflow Compiler Execution
id: 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
status: test
description: |
    Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
references:
    - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
    - https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
author: Nik Seetharaman, frack113
date: 2019-01-16
modified: 2023-02-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
    - attack.t1218
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\Microsoft.Workflow.Compiler.exe'
        - OriginalFileName: 'Microsoft.Workflow.Compiler.exe'
    condition: selection
falsepositives:
    - Legitimate MWC use (unlikely in modern enterprise environments)
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution/info.yml

title: Okta Application Sign-On Policy Modified or Deleted
id: 8f668cc4-c18e-45fe-ad00-624a981cf88a
status: test
description: Detects when an application Sign-on Policy is modified or deleted.
references:
    - https://developer.okta.com/docs/reference/api/system-log/
    - https://developer.okta.com/docs/reference/api/event-types/
author: Austin Songer @austinsonger
date: 2021-09-12
modified: 2026-04-27
tags:
    - attack.impact
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventType:
            - application.policy.sign_on.update
            - application.policy.sign_on.rule.delete
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy
id: bbb9495b-58fc-4016-b9df-9a3a1b67ca82
status: test
description: Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
    - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
author: frack113
date: 2022-03-17
tags:
    - attack.discovery
    - attack.t1201
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: Get-AdDefaultDomainPasswordPolicy
    condition: selection
falsepositives:
    - Legitimate PowerShell scripts
level: low

title: PCRE.NET Package Image Load
id: 84b0a8f3-680b-4096-a45b-e9a89221727c
status: test
description: Detects processes loading modules related to PCRE.NET package
references:
    - https://twitter.com/rbmaslen/status/1321859647091970051
    - https://twitter.com/tifkin_/status/1321916444557365248
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-29
modified: 2022-10-09
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
    condition: selection
falsepositives:
    - Unknown
level: high

title: PCRE.NET Package Temp Files
id: 6e90ae7a-7cd3-473f-a035-4ebb72d961da
status: test
description: Detects processes creating temp files related to PCRE.NET package
references:
    - https://twitter.com/rbmaslen/status/1321859647091970051
    - https://twitter.com/tifkin_/status/1321916444557365248
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-29
modified: 2022-10-09
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
    condition: selection
falsepositives:
    - Unknown
level: high

title: PDF File Created By RegEdit.EXE
id: 145095eb-e273-443b-83d0-f9b519b7867b
status: test
description: |
    Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process.
    This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.
references:
    - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-08
tags:
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\regedit.exe'
        TargetFilename|endswith: '.pdf'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Possible Coin Miner CPU Priority Param
id: 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
status: test
description: Detects command line parameter very often used with coin miners
references:
    - https://xmrig.com/docs/miner/command-line-options
author: Florian Roth (Nextron Systems)
date: 2021-10-09
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.t1068
logsource:
    product: linux
    service: auditd
detection:
    cmd1:
        a1|startswith: '--cpu-priority'
    cmd2:
        a2|startswith: '--cpu-priority'
    cmd3:
        a3|startswith: '--cpu-priority'
    cmd4:
        a4|startswith: '--cpu-priority'
    cmd5:
        a5|startswith: '--cpu-priority'
    cmd6:
        a6|startswith: '--cpu-priority'
    cmd7:
        a7|startswith: '--cpu-priority'
    condition: 1 of cmd*
falsepositives:
    - Other tools that use a --cpu-priority flag
level: critical

title: Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt
id: 245f92e3-c4da-45f1-9070-bc552e06db11
status: test
description: Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
    - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
    - https://github.com/h3v0x/CVE-2021-26084_Confluence
author: Bhabesh Raj
date: 2021-09-08
modified: 2023-02-13
tags:
    - attack.initial-access
    - attack.execution
    - attack.t1190
    - attack.t1059
    - cve.2021-26084
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Monitor suspicious child processes spawned by Confluence
        ParentImage|endswith: '\Atlassian\Confluence\jre\bin\java.exe'
        CommandLine|contains:
            - 'certutil'
            - 'cmd /c'
            - 'cmd /k'
            - 'cscript'
            - 'curl'
            - 'ipconfig'
            - 'powershell'
            - 'pwsh'
            - 'regsvr32'
            - 'rundll32'
            - 'whoami'
            - 'wscript'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
related:
    - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing
      type: similar
    - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network
      type: similar
    - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 # Kerberos Coercion Via DNS SPN Spoofing Attempt
      type: similar
status: experimental
description: |
    Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
    matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
    commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
    attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
    where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
    Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
references:
    - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
    - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-20
tags:
    - attack.collection
    - attack.credential-access
    - attack.t1557.003
    - attack.persistence
    - attack.privilege-escalation
logsource:
    product: windows
    service: security
    definition: |
      By default these events are not logged by default for MicrosoftDNS objects in Active Directory.
      To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal.
      This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).
detection:
    selection_directory_service_changes:
        EventID:
            - 5136
            - 5137
        ObjectClass: 'dnsNode'
        ObjectDN|contains|all: # ObjectDN">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
            - 'UWhRCA'
            - 'BAAAA'
            - 'CN=MicrosoftDNS'
    selection_directory_service_access:
        EventID: 4662
        AdditionalInfo|contains|all: # AdditionalInfo">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
            - 'UWhRCA'
            - 'BAAAA'
            - 'CN=MicrosoftDNS'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via Microsoft Office Startup Folder
id: 0e20c89d-2264-44ae-8238-aeeaba609ece
status: test
description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
references:
    - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
    - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-02
modified: 2023-06-22
tags:
    - attack.persistence
    - attack.t1137
logsource:
    category: file_event
    product: windows
detection:
    selection_word_paths:
        - TargetFilename|contains: '\Microsoft\Word\STARTUP'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\STARTUP'
    selection_word_extension:
        TargetFilename|endswith:
            - '.doc'
            - '.docm'
            - '.docx'
            - '.dot'
            - '.dotm'
            - '.rtf'
    selection_excel_paths:
        - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\XLSTART'
    selection_excel_extension:
        TargetFilename|endswith:
            - '.xls'
            - '.xlsm'
            - '.xlsx'
            - '.xlt'
            - '.xltm'
    filter_main_office:
        Image|endswith:
            - '\WINWORD.exe'
            - '\EXCEL.exe'
    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
falsepositives:
    - Loading a user environment from a backup or a domain controller
    - Synchronization of templates
level: high

title: Potential Persistence Via Outlook Today Page
id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
related:
    - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook today page.
    An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-10
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection_main:
        TargetObject|contains|all:
            - 'Software\Microsoft\Office\'
            - '\Outlook\Today\'
    selection_value_stamp:
        TargetObject|endswith: '\Stamp'
        Details: 'DWORD (0x00000001)'
    selection_value_url:
        TargetObject|endswith:
            - '\URL'
            - '\UserDefinedUrl'
    filter_main_office:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    condition: selection_main and 1 of selection_value_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential Suspicious Windows Feature Enabled - ProcCreation
id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
related:
    - id: 55c925c1-7195-426b-a136-a9396800e29b
      type: similar
status: test
description: |
    Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
    Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
references:
    - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
    - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-29
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        CommandLine|contains|all:
            - 'Enable-WindowsOptionalFeature'
            - '-Online'
            - '-FeatureName'
    selection_feature:
        # Add any insecure/unusual windows features that you don't use in your environment
        CommandLine|contains:
            - 'TelnetServer'
            - 'Internet-Explorer-Optional-amd64'
            - 'TFTP'
            - 'SMB1Protocol'
            - 'Client-ProjFS'
            - 'Microsoft-Windows-Subsystem-Linux'
    condition: all of selection_*
falsepositives:
    - Legitimate usage of the features listed in the rule.
level: medium

title: RDP Sensitive Settings Changed
id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c
related:
    - id: 171b67e1-74b4-460e-8d55-b331f3e32d67
      type: obsolete
    - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3
      type: obsolete
    - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b
      type: similar
status: test
description: |
    Detects tampering of RDP Terminal Service/Server sensitive settings.
    Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

    Below is a list of registry keys/values that are monitored by this rule:

    - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
    - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
    - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
    - fAllowUnsolicited: Allows unsolicited remote assistance offers.
    - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
    - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
    - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
    - SecurityLayer: Specifies the security layer used for RDP connections.
references:
    - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ # Contains description for most of the keys mentioned here (check it out if you want more information)
    - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ # Related to the Shadow RPD technique
    - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services # Contains description for most of the keys mentioned here (check it out if you want more information)
    - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
    - https://blog.sekoia.io/darkgate-internals/
    - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
    - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
    - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
    - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
    - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 # Related to the Shadow RPD technique
    - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html # Related to RDP hijacking via the "ServiceDll" key
    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
date: 2022-08-06
modified: 2025-11-22
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection_shadow:
        TargetObject|contains:
            - '\Control\Terminal Server\'
            - '\Windows NT\Terminal Services\'
        TargetObject|endswith: '\Shadow'
        Details:
            - 'DWORD (0x00000001)' # Full Control with user’s permission
            - 'DWORD (0x00000002)' # Full Control without user’s permission
            - 'DWORD (0x00000003)' # View Session with user’s permission
            - 'DWORD (0x00000004)' # View Session without user’s permission
    selection_terminal_services_key:
        TargetObject|contains:
            - '\Control\Terminal Server\'
            - '\Windows NT\Terminal Services\'
        TargetObject|endswith:
            - '\DisableRemoteDesktopAntiAlias' # Disable anti-aliasing for remote desktop (DarkGate malware)
            - '\DisableSecuritySettings' # Disable security settings, allowing access to programs/entire desktop (DarkGate malware)
            - '\fAllowUnsolicited' # Allow unsolicited remote assistance offers
            - '\fAllowUnsolicitedFullControl'
        Details: 'DWORD (0x00000001)'
    selection_tamper_only:
        # Any changes to these keys should be suspicious and looked at
        TargetObject|contains:
            - '\Control\Terminal Server\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
            - '\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
            - '\services\TermService\Parameters\ServiceDll' # RDP hijacking
            - '\Terminal Server\WinStations\RDP-Tcp\SecurityLayer'
            - '\Windows NT\Terminal Services\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
    filter_main_securitylayer_tls:
        TargetObject|endswith: '\SecurityLayer'
        Details: 'DWORD (0x00000002)' # TLS Enabled
    condition: (selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*
falsepositives:
    - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)
level: high
simulation:
    - type: atomic-red-team
      name: Disable Remote Desktop Anti-Alias Setting Through Registry
      technique: T1112
      atomic_guid: 61d35188-f113-4334-8245-8c6556d43909
    - type: atomic-red-team
      name: Disable Remote Desktop Security Settings Through Registry
      technique: T1112
      atomic_guid: 4b81bcfa-fb0a-45e9-90c2-e3efe5160140